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dtd  17  September  1946)  effective  l October  19A6.  It  Is  an  activity  of  the 
ELEVENTH  Naval  District.  The  Bureau  of  Aeronaut  tcs  exercises  management  and 
technical  control  over  this  activity. 

The  primary  mission  of  the  Naval  Air  Missile  Test  Center  Is  the  testing 
and  evaluation  of  guided  missiles  and  their  components.  NAMTC  Is  assigned 
cognizance  over  all  facll Ittes  at  Point  Mugu,  California,  and  outlying  facilities 
on  San  Nicolas  Island  and  the  Santa  Barbara  Channel  Islands,  collectively 
referred  to  as  the  Sea  Test  Range. 


★ ★ ★ 


Commandtr,  Naval  Air  Mittilt  Tttt  Ctnttr  ...  Captain  E.  M.  Condra,  Jr.,  USN 

Command  inf  Offictr,  Naval  Air  Station  Captain  M,  T.  Evant,  USN 

Dirtctor  of  Ttttt,  Naval  Air  Mittilt  Tttt  Ctnttr ..  Captain  A.  C.  Packard,  USN 
Chitf  Scitntitt,  Naval  Air  Mittilt  Tttt  Ctnttr  Dr.  R. 


Zmi 


* • 1 


RESTRICTED 


r 


RESTRICTED 

TABLE  OF  CONTENTS 


Pa  Re 


SUMMARY  1 

INTRODUCTION  1 

PART  I 5 

BASIC  CONCEPTS  FOR  THE  PLANNING  OF  A RELIABILITY  TEST  PROGRAM  ...  5 

Designing  of  Theoretical  Planning  Curves  5 

Analysis  of  the  Planning  Curves  6 

Reliability  at  the  Beginning  of  a Missile  Development  6 

Reliability  Required  for  the  Flight  Test  Phase  7 

The  Component  Reliability  Required  at  the  Beginning 

of  Mass  Production 9 

The  Scrutiny  of  Component  Reliability  During  Mass 

Production  9 

The  Importance  of  Time  Saving  to  the  Military  Value 

of  a Weapon 10 

Simplicity  in  Design  10 

Ach  ievabi  1 i ty  of  the  Very  High  Levels  of  Component  Reliability  . 11 

The  Chances  of  the  Isolated,  Very  Complex  Missile 13 


i 


PART  II 15 

THE  PRIORITIES  WITHIN  A RELIABILITY  TEST  PROGRAM  15 

Gene  ral 15 

The  "Hitird  of  Fiilure,"  H = m • q ' 16 

Relation  Between  "Hazard  of  Failure"  and  "Probability 

of  Fa  i lure  16 

The  "Priority  Index,"  PI 18 

Two  Examplea  of  Application 18 

Other  Factora  Influencing  the  Teat  Prioritiea  19 

Other  Appllcationa  of  the  Pricrity  Index 20 

Co-operation  Between  Deaigner  and  Reliability  Co-ordinator  . . . 20 

Co-operation  Between  Cont  ractor  and  Contracting  Agency  21 

The  "Total  Hazard"  of  Failure  Produced  by  a Component  Type  ...  21 

Standardization  of  Guided  Miasile  Componenta  21 

Thoroughneas  of  Planning  Work 22 


RESTRICTED 


RESTRICTED 

TABLE  OF  CONTENTS  (Cont'd) 

Pa  ge 

PART  III 23 

Sampling  Problems  23 

Introduction 23 

Standardized  Component  Types  23 

"Best*  Sample  Sizes  for  Standardized  Components  25 

Newly  Developed  Components  27 

The  Prototype  Unit 27 

Obtaining  Maximum  Information  From  an  Isolated  (Prototype) 

Un  it  28 

Sin  K le  Environmental  Condition  28 

Multiple  Independent  Environmental  Conditions  28 

Multiple  Interdependent  Environments  29 

Preflight  Testing  of  Complete  Flight  Test  Missiles  30 

PART  IV 3 3 

PROBLEMS  OF  ORGANIZATION 33 

General 33 

Means  of  Handling  Reliability  Data 34 

The  List  of  Components  35 

The  List  of  Stresses  and  Environmental  Conditions 35 

The  Plan  of  Survey  36 

The  Card  File  of  Hazards 36 

Lists  of  Test  Results  and  the  Reliability  Chart  ....  38 

The  "Poster  of  Erratics"  39 

Establishment  of  a Reliability  Group  3Q 

Composition  of  the  Reliebility  Group  43 

Required  Qualifications  of  the  Members  of  the  Reliability  Group  . 43 

Stability  and  Continuity  of  Purpose  44 

CONCLUSIONS 4 5 

Pa  ge 

ILLUSTRATIONS 

Figure  1.  Development  of  Assumed  Standard  Fighter 2 

Figure  2.  Development  of  Actual  V - 1 2 

Figure  3.  Growth  of  the  Over-All  Reliability  as  a Function  . 

of  the  Rate  of  Component  Development 5 

Figure  4*  Growth  of  Over-All  Reliability  Accelerated  by 

Doubling  Rate  of  Component  Development  8 

RESTRICTED 


r 

I 

RESTIICIEO 

TABLE  OF  CONTENTS  (Cont'd) 

P«R* 


Figure  5.  Growth  of  Over-All  Reliability,  Modified 12 

Figure  6.  Hazard  of  Failure,  H = m * q*.  Versus  the  True 

Contribution.  Qtrue 17 

Figure  7.  Periods  of  Predominant  Use  of  H and  PI  During  a 

Missile  Development 20 

Figure  8.  Scatterband  of  Strengths  of  a Component  Type 24 

Figure  9.  Typical  Organization  for  Reliability  Control 36 

Table  1.  List  of  Components.  34 

Table  2.  PlanofSurvey 37 


* 


RESTRICTED 


rnimtuD 


r 

I 


planning  and  conducting 
reliability  test  programs 
for  guided  missiles 

summary 

Guided  missiles  must  he  made  reliable  essentially  by  ground  testing 
methods,  in  particular  by  conducting  comprehensive  teat  - to  - fa i lure  programs 
for  all  doubtful  component  types  relative  to  all  environmental  conditions 
invo  lved. 

The  desirability  of  conducting  reliability  test  programs  is,  in  principle, 
generally  accepted.  However,  many  people  question  whether  such  test  programs 
can  be  performed  economically  and  within  the  time  limits  set  for  the 
development  of  a guided  missile. 


In  this  study  it  is  shown  (1)  that  achieving  and  maintaining  a satisfactory 
over-all  reliability  program  is  largely  a problem  of  planning  and  organization, 
(2)  that  the  reliability  test  program  should  be  started  when  the  missile  is 
in  its  preliminary  design  stages  and  should  he  conducted,  at  high  priority, 
throughout  the  missile  development  and  continued  as  long  as  the  missile 
re  mains  in  production,  and  (3)  that,  toaccelerate  the  growth  of  the  over-all 
reliability,  appropriate  test  priorities  should  be  established  within  the 
test  program. 

A variety  of  organizational  concepts  and  tools  are  suggested  that  may 
help  to  solve  the  guided  missile  reliability  problem  economically  and  within 
a reasonable  time. 

introduction 

One  of  the  most  difficult  problems  in  developing  guided  missiles  is  how 
to  achieve  and  maintain  a satisfactory  over-all  reliability.  The  reasons 
for  this  are  discussed  in  NAMTC  Technical  Report  No.  75  and  illustrated  by 
two  empirical  diagrams,  here  reprinted  as  figures  1 and  2. 
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Figure  1 s how  s the  characteristically  rapid  g r ow  th  of  reliability  of  a 
piloted  aircraft.  Figure  2 shows  the  growth  of  the  over-all  reliability 
typical  of  guided  missiles  and  illustrates  that  ( 1 1 the  initial  reliability 
is  practically  zero,  (2)  the  growth  of  the  reliability  is  slow,  (31  the 
maximum  reliability  that  can  be  achieved  is  much  lower  than  that  of  piloted 
aircraft,  (4)  the  difficulty  of  ma  i n t a i n i n g even  this  1 ow  ma  x i mum  is 
considerable  once  the  missile  is  distributed  for  service. 

This  S low  and  arduous  growth  of  over-all  reliability  is  typical  of  very 
,c  on  p 1 ex  , nonrecoverable,  a u t oma  t i c devices,  such  as  guided  missiles  and, 
to  a limited  extent,  torpedoes.  Guided  missiles,  which  are  even  more 
complex  than  torpedoes  and  also  much  less  recoverable,  impose  the  most 
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difficult  reliability  problem  of  all  weapons.  Conseq  ue  n t 1 v 
solution  of  the  guided  missile  reliability  problem  requires 
concepts  and  means,  such  as  comprehensive  t e s t - t o - f a i 1 u r e 
subject  all  component  types  to  all  stresses  and  environmental 


, satisfactory 
ext  raord  inary 
programs  that 
c ond i t i on s . 


Up  to  now,  the  need  of  planning  for  rapid  development  of  over-all 
reliability  has  not  been  considered  sufficiently  because  of  the  widespread 
and  erroneous  belief  that  guided  missiles  could  be  made  reliable  through 
application  of  the  customary  concepts  applied  in  all  "normal*  technical 
fields,  such  as  the  development  of  piloted  aircraft.  For  this  reason 
experience  in  planning  for  the  achievement  of  missile  reliability  is  at 
present  seriously  lacking.  It  may  take  many  more  years  of  missile  develop- 
ment and  experience  to  establish  a comprehensive  basis  for  such  planning  by 
using  ordinary  industrial  concepts.  In  any  case,  the  time  required  would  be 
much  too  long  to  prove  beneficial  for  those  guided  missile  types  now  being 
planned  and  developed. 


An  attempt  is  made  in 
trends  of  reliability  that 
reliability  test  program, 
tools  for  organizing  such 


this  study  to  delineate  the  basic  factors  and 
must  be  considered  in  planning  and  performing  a 
and  to  point  out  a variety  of  new  concepts  and 
pr  o g r ams . 


This  report  is  the  third  in  a series  of  NAMTC  reports  on  reliability  of 
guided  missiles.*  It  is  recommended  that  the  reader  study  the  first  two 
reports  for  a better  understanding  of  this  third  one. 


★ ★ ★ 


*NAMTC  Technical  Report  No.  75: 
NAIfTC  Technical  Report  No.  84: 
Miaaiie  Coiapone  nt  a" . 


"A  Study  of  Method!  for  Achieving  Reliability  of  Guided  Milliiei." 
"General  Specification!  for  the  Safety  Margina  Required  for  Guided 
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basic  concepts  for  the  planning  of  a reliability  test  program 

DESIGNING  OF  THEORETICAL  PLANNING  CURVES 

A family  of  theoretical  curves,  showing  an  assumed  growth  of  over-all 
reliability  for  guided  missiles,  is  presented  in  figure  3. 


96  98  99  99.5  99.75  99.87  99.94  99.97  99.98  p‘.  reliability,  per  cent 

3 . Growth  of  the  Over-All  Reliability  as  a Function 
of  the  Rate  of  Component  Development. 

The  curves  are  obtained  on  the  basis  of  the  formula  for  the  over-all 
re  1 i ab i 1 i t y 


P 1 

ove  r - a 1 1 


pi  . p2 


The  terms  Pj,  p^,  P^,  denote  the  Indices  of  Reliability**  of  the 
individual  components  of  a missile;  n indicates  the  number  of  all  doubtful 
component s to  be  scrutinized  and  isused  here  as  a measure  of  the  "Reliability 
Comp le xi ty "* o f a missile.  The  letter  pj  indicates  the  general  level  of 
component  reliability  achieved  at  the  various  stages  of  development.  For 
simplicity  of  discussion  it  may  be  assumed  that  all  doubtful  missile 
components  have  the  same  reliability,  expressed  by  p.' . Thus  one  will  arrive 
at  the  short  form: 

p ' < n 
ove  r- al 1 ~ pi 


This  is  the  form  used  in  the  computation  of  the  curves  in  figure  3. 


• See  NAIfTC  Technical  Report  No.  7S.  P*|«a  13  and  14  and  figure  3. 

♦ •For  diteuiaion  of  "indices  of  Reliability”  aee  NAIfTC  Technical  Report  No.  14,  page*  46-50. 


RESTRICTED 


5 


RESTRICTED 


In  desiring  the  curves  of  figure  3 , two  more  parameters  must  he  assumed: 


1 . The  level  of  component  reliability  available  at  the  beginning 
of  a development.  This  level  is  assumed  to  be  p|(initial)  « 96 
per  cent.  Such  a low  level  may  be  appropriate  for  much  of  guided 
missile  development  at  its  present  stage. 

2 . The  rate  of  growth  of  the  reliability  of  all  components.  The 
assumption  is  made  that  the  chance  of  failure  of  components  can  be 
halved  every  year,  for  example,  q = 4;  2;  1;  .5  ....  per  cent.  In 
this  case  the  ratio  of  the  number  functioning  units  to  one  failing 
unit  will  progress  as  follows:  25-  50:  1 1 10  0 : 1 » 200 : 1 . * ‘ ’ f see 
abscissa  in  figure  3).  The  assumption  of  such  a rate  pf  growth  may 
be  justified  if  one  realizes  that  the  knowledge  of  the  techniques 
and  "arts"  related  to  guided  missiles  at  present  is  still  meager. 


One  may  view  these  parameters  mo  re  opt imis  t ica 1 ly  or  more  pessimistically. 
Whatever  one's  attitude  is,  the  family  of  curves  need  not  be  recomputed  and 
redrawn.  One  has  only  to  shift  the  origin  of  the  time  scale  to  the  desired 
p!  (initial),  and  expand  or  contract  the  time  scale  to  acccrd  with  the 
desired  rate  of  growth. 


In  spite  of  the  theoretical  character  of  these  curves,  they  can  be  used 
for  reaching  important  conclusions  in  the  planning  and  conducting  of 
reliability  test  programs.  This  will  be  discussed  in  the  next  chapter. 


ANALYSIS  OF  THE  PLANNING  CURVES 

Reliability  at  the  Beginning  of  a Missile  Development 

Figure  3 shows  that,  at  the  beginning  of  a missile  development,  the 
theoretical  over-all  reliability  is  practically  zero,  if  p|  (initial)  = 
96  per  cent.  This  would  be  true  for  even  a relatively  simple  missile 
(n  = 100,  for  example).  In  order  to  start  with  a markedly  better  initial 
over-all  reliability  for  complexity  of  n = 100,  the  initial  level  of 
component  reliability  should  at  least  be  as  high  as  p^  (initial)  = 99  per 
cent.  This,  however,  cannot  be  expected  because  many  of  the  components  are 
not  yet  designed,  and  certainly  not  tested,  at  the  outset  of  missile 
deve lopment . 

First  Conclusion:  It  is  very  desirable  that  the  development  of  a 

guided  missile  be  based  as  far  as  p oss i b 1 e on  components  and  elements 
that  are  already  developed  to  a high  reliability,  and  which  are 
standardized  for  use  in  guided  missiles. 
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Reliability  Required  for  the  Flight  Test  Phase 

Flight  test  programs  for  guided  missiles  can  be  subdivided  according 
to  the  three  main  categories  of  tasks: 

1.  Determination  of  the  maximum  stresses  and  environmental  conditions 
during  launching  and  flight. 

2.  Determination  of  the  optimum  adjustments  of  performance  parameters, 
such  as  the  feed  back  ratio  of  servo  loops. 

3.  Determination  of  the  hit  probability  of  the  weapon. 


The  progress  and  success  of  each  category  of  flight  tests  obviously 
depends  1 a r ge i y on  the  reliability  of  the  missiles  used  for  the  various 
tests  . 

Figure  3 demonstrates  that  when  the  flight  test  program  can  be  begun 
after,  for  example,*  2 years  of  development,  the  over-all  reliability  of  a 
flight  test  missile  is  probably  no  better  than  a few  per  cent.  f As  an 
example,  see  ordinate  for  n = 300  at  2 years.)  Consequently,  the  expensive 
and  time-consuming  flight  test  progarm  obviously  will  suffer  greatly  from 
numerous  missile  failures  that  will,  frequently,  have  nothing  to  do  with  the 
actual  objectives  of  the  various  test  flights. 


Second  Conclusion:  The  majority  of  " series  componen t s”  ought  to  be 
developed  to  a satisfactory  degree  of  functional  reliability  be  fore 
the  flight  test  program,  e mp 1 oy in  g more  or  less  comp  1 e t e test 
missiles,  is  in  full  ope  ra  t ion . Consequently,  a reliability  test 
program  must  be  started  at  the  very  beginning  o f a missile  de ve 1 opmen t 
and  must  be  accelerated  with  every  resource. 


Occasionally  the  objection  is  made  that  with  the  institution  of  a 
reliability  test  program  the  total  expense  of  a missile  development  would 
become  insupportable.  Let  us  see  what  the  economic  advantages  of  such  a 
program  are. 


*The  "beginning"  of  the  actual  flight  teat  progreai  cennot  be  defined  precisely  beceuae  it  ahould  be 
preceded  by  the  firing  of  dunay  mieeilee  and  aore  einpie  teat  aiaaliea  required  to  determine  the 
envlronmentel  conditions  during  launching  and  flight.  The  beginning  of  the  flight  tast  progrea 
ea  understood  in  this  study  mey  be  defined  as  "the  stage  of  development  where  the  efforts  end 
expenses  for  flight  teat  missiles  and  for  flight  testing  become  e dominant  factor  in  the  over-eil 
economy  of  the  deva  i opment  • " 
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Fig.  4-  Growth  of  Over-All  Reliability  Accelerated  by 
Doubling  Rate  of  Component  Development. 

In  figure  4 the  theoretical  curve  of  growth  of  a missile  comprising 
n = 300  doubtful  components  is  reprinted  from  figure  3 as  an  example.  At 
the  outset  of  the  actual  flight  test  program  ("which  it  may  be  assumed  will 
start  2 years  after  the  project  has  begun),  the  over-all  reliability  would 
be  as  low  as  5 per  cent  (0.99300  = 0.049).  (See  figure  4.1  Accordingly 
20  missiles  would  have  to  be  expended  in  order  to  achieve  one  completely 
successful  firing.  If  all  the  components  could  be  improved  at  twice  the 
rate  originally  ass umed,  the  dashed  curve  in  figure  4 wou Id  be  obtained,  wh i ch 
will  indicate  an  over-all  reliability  of  47  per  cent  (0.9975^^®  ■=  0.472)  at 
the  start  of  the  flight  test  program.  Now  only  two  missiles  would  have  to 
be  fired  in  order  to  achieve  one  complete  success!  It  is  thus  apparent 
that  the  over-all  reliability  in  this  case  would  be  raised  not  by  the  factor 
2.,  as  one  might  offhandedly  presume,  hut  by  the  factor  10. 

This  simplified  example  shows  how  an  accelerated  reliabilitytest  program 
could  result  in  a saving  of  18  (i.e.,  20-2)  expensive  test  missiles  per 
missile  successfully  fired.  In  this  stage  of  development  missiles  are 
particularly  expensive  and  valuable  to  the  development  program  even  if  they 
are  not  elaborately  equipped.  Thus,  assuming  an  average  cost  for  one  missile 
of  $100,000,  the  total  savings  would  amount  to  $1,800,000  for  each  missile 
successfully  fired. 

One  may  consider  this  figure  as  somewhat  exaggerated  because  a flight 
test  missile  that  failed  at  some  later  stage  of  its  flight  may  yield  at  least 
some  partial  test  results.  However,  in  the  third  stage  of  flight  testing, 
where  the  pattern  of  hits  is  to  be  determined,  a missile  must  at  least  be 
capable  of  reaching  the  target  area  before  it  can  be  considered  as  contributary 
to  the  pattern  of  hits. 

At  any  rate,  it  is  believed  that  even  with  a fraction  of  such  savings 
one  can  easily  double  the  usual  low  rate  of  component  improvement. 
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These  ,'ons  iderat  ions  do  not'  give  the  complete  economic  advantages  of  a 
reliability  program.  One  must  realize  that  many  more,  possibly  hundreds  of 
missiles,  could  be  "saved"  ( i . e . , would  be  successes  instead  of  duds)  during 
training,  aid  in  service  use.  Such  savings  may,  in  some  cases,  exceed  the 
expenses  of  a complete  reliability  test  program  by  several  orders  of 
magnitude ! 

Third  Conclusion:  The  conduct  of  a thorough  reliability  test 
program  can  be  considered  as  a highly  econom ica 1 method  for  ach iev in g 
reliable  service  missiles. 

The  Component  Reliability  Required  at  the  beginning  of  Mass  Production 

The  most  critical  stage  in  the  development  of  a guided  missile  will 
occur  when  mass  production  is  to  be  started.  Py  that  time,  and  not  later, 
proof  must  have  been  established,  through  extensive  flight  testing  and  under 
simulated  combat  conditions,  that  the  missile  type  has  actually  attained  an 
over-all  reliability  that  is  satisfactory  from  the  military  standpoint. 

There  need  be  only  one  weak  component  typetomake  a missile  undeservedly 
unserviceable.  If  such  faulty  component  types  are  still  present  at  the 
beginning  of  mass  production,  one  can  hardly  prevent  them  from  being  caught 
up  in  the  inexorable. and  inflexible  process  of  mass  production,  and  so 
become  hidden  hazards  to  the  success  of  the  weapon. 

Fourth  Conclusion:  Components  that  are  found  to  be  unreliable 
shortly  before  the  beginning  of  mass  production  must  be  perfected 
and  made  reliable  with  utmost  dispatch.  Very  high  priorities  must 
be  granted  for  the  testing  and  improving  of  such  " late " components. 


The  Scrutiny  of  Conu  'nent  Reliability  During  Mass  Production 

One  could  presume  that  a reliability  test  program  could  be  closed  or 
relaxed  once  mass  production  and  quality  control  are  in  full  operation. 
Such  a view,  however,  entirely  misinterprets  and  underestimates  the  purposes 
of  reliability  scrutiny  and  reliability  testing.* 

Mass  production  of  a new  missile  involves  a cumbersome  gearing  up  on  a 
broad  industrial  basis,  with  new  firms  and  personnel  that  are  oftentimes 
inexperienced.  As  a result,  a considerable  lowering  of  the  general  level 
of  component  reliability,  as  well  as  the  occurence  of  "erratic"  components 
must  be  expected.  The  over-all  reliability,  being  extremely  sensitive  to 
such  setbacks,  may  easily  drop  to  an  entirely  unsatisfactory  level.  One 
must  realize  that  the  natural  tendency  of  the  over-all  reliability  of  a 

*For  the  purposes  of  reliability  testing  see  page  40. 
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guided  missile  is  to  drop  (see  figure  2).  If,  therefore,  the  specific 
testing  and  scrutinizing  of  the  over-all  reliability  were  discontinued 
during  mass  production,  the  missile  weapon  jiiH  soon  become  unserviceable 
without  anyone  realizing  it. 

In  addition',  one  must  expect  that  during  the  period  of  production, 
distribution,  and  operation,  some  of  the  environmental  conditions  (as  in 
transportation,  storage,  handling,  etc.)  will  become  much  better  known,  and 
will  call  for  alterations  in  numerous  types  of  components  and  necessitate 
still  further  reliability  testing  and  scrutinizing. 

Fifth  Conclusion:  Reliability  test  programs  must  be  continued  as 
long  as  a missile  type  is  being  produced.  The  more  a guided  missile 
type  has  proven  its  military  value,  the  more  such  a test  program 
needs  to  be  intensified. 

The  Importance . of  Time  Saving  to  the  Military  Value  of  a Weapon 

The  time  required  to  develop  a new  weapon  to  an  acceptable  level  of 
military  value  is  of  primary  importance  for  the  chances  of  success  in  any 
development.  A new  weapon  that  may  be  extremely  valuable  2 years  from 
today  maybe  already  obsolete  in  4 years.  Thus  the  time  factor  may  outweigh 
all  other  considerations. 

Occasionally  one  hears  the  objection  that,  because  of  the  overwhelming 
importance  of  the  time  factor,  a cumbersome  and  time-consuming  reliability 
test  program  should  be  omitted  or  greatly  cut  down  in  favor  of  speeding  up 
flight  testing.  This  is  a dangerous  mistake!  In  order  to  raise  the 
reliability  of  guided  missile  components  to  the  required  extremely  high 
level,  one  can  rely  very  little  on  flight  testing  and  not  at  all  on  service 
use,  in  contrast  to  the  case  of  piloted  aircraft. 

■Sixth  Conclusion:  Speeding  up  a reliability  test  program  not  only 
will  reduce  the  total  expense  of  a development,  but  will,  through  a 
reduct  ion  in  the  time  of  the  missile  development,  directly  increase 
the  military  value  of  the  guided  missile. 

Simplicity  in  Design 

Figure  3 demonstrates  the  influence  of  the  complexity,  n,  on  the  time 
required  for  a project  development.  For  example,  a missile  type  comprising 
n = 100  doubtful  components  might  attain  an  80  per  cent  over-all  reliability 
after  4 years  of  development.  A missile  comprising  n = 500  components  on 
the  same  quality  level  would  need  about  7.5  years  (or  more,  as  will  be  shown 
later)  to  reach  the  same  reliability. 

Seventh  Conclusion:  In  the  interest  of  saving  time,  both  from  the 
economical  as  well  as  the  military  standpoint,  it  is  necessary  to 
strive  for  simplicity  in  design. 
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Ach i evabi 1 i ty  of  Very  High  Levels  of  Comp  on en  t Reliability 

With  an  increase  in  the  complexity,  n,  the  curves  shift  more  and  more 
to  the  right  hand  side  of  figure  3.  They  are,  however,  identical  with 
respect  to  their  S- shape  and  slant.  This  could  lead  one  to  believe  that 
very  complex  missiles  (n  ^ 1,000,  for  example)  would,  in  principle,  have  the 
s a me  chance  of  becoming  as  reliable  as  simple  missiles  (n  - 100,  for  example ) , 
after  an  initial  period  of  "below  1 per  cent  reliability"  has  been  overcome. 
(For  the  example  of  n - 1,000,  this  period  would  extend  over  about  3.5 
years,  according  to  figure  3.) 

Such  a belief,  however,  is  certainly  much  to  optimistic!  Experience 
has  shown  that  it  is  increasingly  difficult  to  achieve  perceptible  gains  at 
the  higher  levels  of  component  reliability.  Some  reasons  for  this  are:  (1) 
With  a rising  level  of  component  reliability,  general  expenditures  for  the 
tests  need  to  be  increased  progressive  ly.  (2)  If  a "lot"  is  inspected 
again  and  again  by  various  inspectors,  more  and  more  of  the  defective  units 
will  be  detected.  Therefore,  the  higher  the  reliability  bracket  the  less 
confidence  statistical  test  results  merit.  (3)  The  detection  of  "assignahle" 
causes  of  failures  becomes  increasingly  more  difficult  the  closer  the  core 
of  the  constant  svstemof  chance  causes  is  approached.*  (4)  We  are  approach- 
ing the  limits  of  human  fallibility. 

Eighth  Conclusion:  It  is  much  more  difficult,  expensive,  and  time- 

consuming  to  double  the  level  of  component  reliability  in  the  region 
of  99.9  per  cent,  ( q ' - 1:1,000)  than  in  the  region  of  99  per  cent 
( q'  - 1:100)  or  in  the  region  of  90  per  cent  ( q‘  — 1:10). 

Ninth  Conclusion:  Complex  missiles  are  particularly  handicapped  by 

the  fact  just  mentioned.  There  are  not  only  larger  numbers  of 
components  ( n)  to  be  developed  and  sc  run t in i zed , but  these  components 
require,  at  the  same  time,  a much  higher  I eve  1 o f componen  t reliability 
(p'j)  for  achieving  a specified  over- all  reliability.  I \ should  be 
remembered  that  the  difficulty  of  making  a complex  system  reliable 
is  roughly  proportional  to  the  square  * * of  the  number  n of  the 
compon en  t s . 


The  facts  presented  in  the  eighth  and  ninth  conclusions  prove  that  the 
family  of  curves  in  figure  3 gives  an  obviously  too  optimistic  picture  and 
should  therefore  be  modified.  This  can  be  done  by  progressively  expanding 
the  time  interval  required  for  doubling  the  level  of  component  quality.  In 
figure  5 it  is  tentatively  assumed  that  each  subsequent  time  interval 
required  for  doubling  the  level  of  reliability  would  be  10  per  cent  larger 
than  the  preceeding  interval  (see  q/  and  p-  scales).  Thus,  by  simply 

*For  definition  of  "assignable"  eauaea  and  "chance"  eauaei,  see  W.  A.  Shewart,  "Economic  Control 
of  Quality  of  Manufactured  Products,"  pages  12  and  130, 

**See  NAMTC  Technical  Report  No.  75.  page  16.  point  3. 
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replotting  the  curves  of  figure  3,  a more  realistic  picture  of  the  general 
trends  of  reliability  development  is  obtained.  Compared  with  figure  3>  the 
curves  of  growth  in  figure  5 are  progressively  stretched. 


96  98  99  995  9975  99.87  9994  p-  reliability,  per  cent 

Fig.  5.  Growth  of  Over-All  Reliability,  Modified. 


Figure  5 will  be  discussed  by  means  of  two  examples:  ( 1 ) A simple 
missile,  containing  n - 100  critical  or  doubtful  components,  might  attain 
an  over-all  reliability  of  70  per  cent  after  4 years  of  development  (p|  = 
99.63;  q{  = 1:300),  and  (2)  a complex  missile,  containing  n = 1,000  components 
of  the  same  quality  level  ( pj  = 99.63  per  cent)  would  only  attain  a 3 per 
cent  over-all  reliability  in  the  same  period  of  development.  To  achieve 
the  desired  70  per  cent  over-all  reliability,  the  level  of  component 
reliability  would  have  to  be  raised  as  high  as  p j = 99.975  per  cent  (or  q ^ = 
1: 3 , 500 , i . e . on  the  average  only  1 unit  in  3,500  may  fail).  This  might  be 
achieved  after  9 years  of  intensive  development — or  never,  as  will  now  be 
discussed  . 

It  is  very  questionable  whether  such  high  levels  of  component  reliability 
are  at  all  feasible.  With  increasing  complexity  and  cost,  the  total  number 
of  missiles  that  can  be  produced  would  unavoidably  decrease.  The  benefits 
to  quality  derived  from  modern  methods  of  mass  production  and  quality 
control  will  decrease  also.  The  number  of  component  units  will  finally 
become  too  small  for  testing  to  failure  on  a sound  statistical  basis. 

On  the  other  hand,  flight  testing  will  become  a more  and  more  unacceptable 
risk,  firstly,  because  of  the  very  high  cost  of  one  test  missile,  and, 
secondly,  because  of  the  very  slight  chance  that  such  a complex  missile 
will  function  properly  during  its  single*  flight. 

Tenth  Conclusion:  The  wax imum  over- all  reliability  achievable  will 

decrease  sharply  with  increasing  complexity. 

‘Recoverable  te»t  mlieilei  ere  lee*  critical  in  thla  respect.  Such  missiles  are,  however,  feasible 
only  in  few  esses. 
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To  illustrate  these  adverse  influences,  the  upper  sections  of  the  curves 
in  figure  5 are  leveled  off  tentatively  (see  dashed  branches).  The  curves 
for  the  more  complex  missiles  are  leveled'off  at  an  earlier  stage,  because 
it  will  be  much  more  difficult  to  scrutinize  cont  inuoijs  ly  the  many  c ompone  nt  s 
of  a very  complex  missile,  than  to  evaluate  only  the  few  com po nents  of  a 
s imple  missile. 


The  Chances  of  the  Isolated,  Very  Comp  lex  Missile 

A very  complex  missile  being  built  in  one,  or  a few,  prototype  units 
only,  presents  the  extreme  case.  Even  if  it  could  be  proved  theoretically 
that  such  a missile  wou  Id  function,  there  is  no  chance  of  practical  app 1 icat ion 
because  it  is  impossible  to  achieve  a reasonable  over-all  reliability. 

Eleventh  Conclusion:  Very  complex  guided  missile  types  being  built 

in  one  , or  few , un  i t s on  1 y mus  t be  considered  comp  1 e t e ly  impracticable. 


The 

que  s t i on 


following  parts  of  this  study  are  devoted  in  particular  to  the 
of:  How  can  the  growth  of  the  over-all  reliability  be  accelerated? 


★ ★ ★ 
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PART  II 

the  priorities  within  a reliability  test  program 

GENERAL 

In  NAMTC  Technical  Report  No.  75  it  was  recommended  that  within  the 
organization  of  t he  missile  devel  opmen  t contractor,  and  within  the  sponsoring 
government  agency,  there  be  designated  for  each  missile  project  a "reliability 
co-ordinator."  The  task  of  this  co-ordinator  would  be  to  stimulate  testing 
activity  for  obtaining  reliability  data  and  to  gather  and  evaluate  these 
data  systematically. 

In  the  planning  of  a reliability  test  program  the  reliability  co- 
ordinator wil  1 be  confronted  with  a long  chain  of  combinations  of  components 
and  environmental  conditions,  called  "test  cases,"  the  reliabilities  of 
which  are  unknown  and  possibly  critical.  One  should  always  keep  in  mind 
that  a great  many  sensitive  components  will  suffer  not  only  from  one  kind 
of  stress  or  condition  but  from  several.  Thus  the  chain  of  weak  links 
becomes  correspondingly  longer  - and  weaker. 

As  pointed  out  in  Part  I,  these  many  doubtful  combinations  should  be 
tested  at  once  and  at  very  high  priority  in  order  to  achieve  the  urgently 
needed  rapid  growth  of  the  over-all  reliability. 

Even  if  high  priority  is  granted  to  a reliability  test  program  as  a 
whole,  the  test  capacities,  i.e.,  manpower,  facilities,  and  material,  will 
always  be  insufficient  for  starting  and  conducting  all  the  many  test  cases 
in  the  same  early  period.  As  a result,  many  of  the  test  cases,  even  if 
they  are  known  to  be,  or  suspected  of  being,  critical  to  the  missile,  must 
of  necessity  be  postponed.  Again  and  again  the  question  will  arise  as  to 
which  of  the  many  test  cases  should  be  'given  priority  within  the  reliability 
test  program. 

Test  priorities  result  often  merely  from  the  competition  for  the 
limited  test  facilities  and  little  or  no  consideration  is  given  to  the 
vital  question  of  how  the  growth  of  the  over-all  reliability  can  best  and 
most  efficiently  be  accelerated. 

This  task  belongs  obviouslyin  the  realm  of  the  Reliability  co-ordinator, 
who  is  ‘rained  to  see  the  complete  picture  of  guided  missi.le  reliability 
and  who  is  largely  responsible  for  it. 

In  determining  the  test  priorities'  the  reliability  co-ordinator  should 
be  guided  predominantly  by  the  demand  for  the  most  rapid  growth  of  the 
over-all  reliability.  ' For  this  purpose  a priority  system  is  suggested  that 


RESTRICTED 


RESTRICTED 


will  help  to  separate  out  the  test  cases  most  likely  to  contribute  to  the 
growth  of  the  over-all  reliability. 

The  " Hazard  of  Failure ,"  H = m * q'  . 

For  determining  the  test  priorities,  a rational  nnd  convenient  formula 
must  be  derived.  For  this  purpose  one  has  to  consider: 

m = the  frequency  of  occurence  of  a component  type  in  a missile 
q*  =.  the  actual,  or  estimated  index  of  probability  of  failure  of  that 
component  type  relative  -to  a certain  kind  of  stress. 


By  multiplying  these  two  factors,  the  "hazard  of  failure,"  H = m * q', 

is  obtained,  which  indicates  approximately  how  much  a "test  case"  could 
contribute  to  the  over-all  probability  of  failure,  Qover_au*  of  a missile. 
For  example,  a rate  gyro  that  occurs  twice  in  a missile,  and  that  has  a 
probability  of  failure  of  3 per  cent,  will  cause  a failure  hazard  of  m * q ' 
= 2 * 3 ~ 6 per  cent.  A type  of  vacuum  tube  that  is  used  48  times  in  a 

missile,  and  has  a probability  failure  of  "only"  0.5  per  cent,  would  cause 
a failure  hazard  o f m * q ' = 48  * 5 = 24  per  cent.  It  is  evident  that  the 
vacuum  tube  should  have  a much  higher  priority  in  the  reliability  test 
program  than  the  gyro. 

Thus  the  hazard  of  failure,  H ~ m * q*,  is  a handy  tool  for  determining 
in  what  order  the  many  test  cases  that  are  competing  for  priority  should 
receive  attention- 

RELATION  BETWEEN  " HAZARD  OF  FAILURE"  AND  " PROBABILITY  OF  FAILURE.  9 

The  truth  of  the  statement  that  the  hazard  of  failure,  H - m • q| 
indicates  directly  the  contribution  Q to  the  over-all  probability  of 
failure  of  the  missile,  is  not  se  1 f - appar en t . In  fact,  persons  familiar 
with  statistics  may  object  that  the  statement  is  inaccurate  Thus  some 
explanation  is  required. 

The  true  contribution  Qtrue  of  a component  type  to  the  over-all  proba- 
bility of  failure  of  a missile  is  obtained  by  the  formulas: 

i.  p'  = (i  - qi'Ki  - q2')a  “ q3')  *'•  a - O **•  <1  - 

2 • Qtrue  =1  “ P* , 

where  P = probability  of  success,  or  the  reliability,  of  a group  of  m units, 
having  probabilities  of  failure  of  qj;  qj ; q^  **•  q^. 

These  formulas  are  correct  though  not  handy  for  the  purpose  of  scrut iny. 
Much  more  practical  is  the  arbitrary  concept  that  the  contribution  Q equals 
simply  the  sum  of  the  q* *s  of  the  m units  occuring  in  the  missile: 
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Fig.  6.  Hazard  of  Failure,  H = m * q',  Versus  the  True 
Contribution,  Qfrue* 


Figure  6 shows  that  the  hazard  of  failure,  H = m • q',  is  practically 
identical  with  the  true  contribution,  Q^rue’  only  for  small  valuesof  m * q*. 
The  discrepancy  between  H and  Qtrue  becomes  increasingly  larger  as  m * q' 
increases.  This,  however,  does  not  diminish  the  usefulness  of  the  simplified 
concept,  because: 


1.  The  great  majority  of  all  component  types  fall  into  the  low  range 
of  m * q1  ( i • e . below  5 s 10  per  cent).  If  this  were  not  the  case,  a 
guided  missile  would  be  hopelessly  unreliable. 
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2.  It  is  very  desirable  that  the  urgency  of  the  test  cases  showing 
high  hazards  of  failure  m • q ' be  even  overemphasized  through  the  priority 
scale.  (See  example  of  vacuum  tube  on  page  16-) 


Thus,  one  arrives  at  the  conclusion  that  the  hazard  of  failure,  m * q*, 
though  not  always  exactly  identical  with  the  true  contribution  Q^rue  can  be 
considered  an  appropriate  tool  for  determining  the  test  priorities. 

THE  " PRIORITY  INDEX,”  PI 

If  the  hazard  of  failure,  H — m * q',  were  to  be  used  as  the  <?  n 1 y 

criterion  for  determining  test  priorities,  it  might  frequently  occur  that 
one  bulky  test  case  would  block  several  others,  which  together  could 
possibly  contribute  much  more  to  the  urgently  needed  growth  of  the  over-all 
reliability  of  the  entire  missile.  This  should  be  avoided  carefully. 
Consequently,  one  must  consider  not  only  the  hazard  of  failure,  H z m • q*, 

in  determining  the  test  priorities,  hut  also  those  factors  that  tend  to 
retard  the  performance  and  the  completion  of  the  tests.  Such  factors  are: 

a - cost  of  procurement  of  one  test  unit,  expressed  in  units  of  a 
thousand  dollars, 

b z cost  for  conducting  and  evaluating  one  single  test,  expressed  in 
units  of  a thousand  dollars. 

c z cost  for  preparing  a particular  test  case,  i.e.,  cost  of  special 
testing  facilities,  and  of  establishing  the  theoretical  basis  for  the  tests, 
in  units  of  a thousand  dollars! 

N = number  of  units,  or  sample  size,  required  for  determining  the 
re  liabi 1 ity. * 
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these  factors  and  notations,  and  also  the  "Hazard  of 
• q * (defined  above),  a "Priority  Index,"  PI,  can  be 
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as  a tool  for  determining  the  priorities  within  a test  program: 
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The  greater  PI,  the  better  the  chances  that  a component  type,  by  being 
tested  and  improved,  will  contribute  to  the  rapid  growth  of  the  over-all 
reliability  of  a missile.  Consequently,  it  is  proper  to  place  test  cases 
with  large  priority  indices  well  ahead  in  the  general  reliability  program. 


TWO  EXAMPLES  OF  APPLICATION 


1.  Component  type  A,  occuring  only  once-  (m  = 1)  in  the  missile,  may 
have  a known,  or  estimated  probability  of  failure  of  q*  = 5 par  cent.  Let 
us  assume  that  a sample  of  N z 15  units  is  to  be  tested.  Cost  of  procure • 

*The  problem  of'choosing  the  "beet"  temple  eiee  will  be  discussed  In  detail  in  Part  III  of  thie 
etudy.  For  thie  phase  of  the  discussion  it  may  be  accepted  that  in  choosint  the  sample  else  an 
optimum  can  be  approached. 
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merit  of  one  unit  may  be  $100,  (a  - 0.1).  The  cost  of  conducting  and 
evaluating  of  one  test  may  be  estimated  as  $50  (b  - 0.05)  and  the  expense 

of  preparing  the  test  as  $250  (c  r 0.25).  Then 

PI  r 2 

15(0.1  + 0.05)  + 0.25 

2.  Component  B,  occuring  in  one  missile  120  times  (m  r 120),  may  have 
a probability  of  failure  of  "only  q'*  - 0.25  per  cent.  The  required  sample 

size  is  N ~ 60  units.  Cost  of  procurement  of  one  piece  $1  (a  — 0.001). 
Cost  of  one  test  $3  ( b — 0.003).  Cost  of  test  preparation  $500  (c  ~ 0.5). 

PI  - 5 - 4Q 

60(0. 001  + 0. 003)  +0.5 


Obviously  component  type  B ought  to,  and  can  be,  tested  with  a much  higher 
priority  rating  than  component  type  A,  not  only  because  it  produces  the 
enormously  high  hazard  of  failure  of  30  per  cent,  but  also  because  it  can 
be  manufactured  and  tested  easily  and  relatively  inexpensively. 


It  cannot  be  overemphasized  that  over  the  years  of  a reliability  test 
program  the  majority  of  the  component  types  need  to  be  tested  again  and 
again.  Thus  the  various  factors  of  the  priority  index  will  become  better 
and  better  known.  The  reliability  co-ordinator  will  thus  be  able  to  adapt 
the  test  priorities  to  the  changing  conditions  of  the  missile  development 
with  increasing  certainty. 


OTHER  FACTORS  INFLUENCING  THE  TEST  PRIORITIES 

The  priority  index,  PI,  as  well  as  the  hazard  of  failure,  m • q ,'  will 
not  be  the  only  factors  for  determining  the  eventual  priorities  within  a 
reliability  test  program.  Various  other  factors  must  be  taken  into  consider- 
ation, such  as  the  momentary  availability  of  a certain  type  of  component, 
or  of  test  facilities,  or  of  test  specialists.  It  may  also  happen  that  a 
component  type  requires  highest  priority  because  it  is  an  essential,  yet 
doubtful,  integral  part  within  a very  important  system. 

Therefore,  of  all  the  factors  involved  in  determining  priorities,  the 
priority  index,  PI,  is  intended  to  serve  as  the  one  guiding  factor  used  in 
the  planning  process  that  will  provide  for  acceleration  of  the  growth  of 
the  over-all  reliability  of  the  missile  in  the  early  stages  of  development. 

The  hazard  of  failure,  H = m * q*,  asa  guide  for  priority,  is  to  be 
preferred  in  the  later  stages  of deve  lopments ,whe re  the  over-all  reliability 
of  the  missile  must  be  raised  to  its  highest  possible  level  even  though 
great  expense  may  be  involved. 
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PER  CENT  CN/ER-ALL  RELIABILITY 


Fig.  7.  Periods  of  P r edomin  an  t Use  of  H and  PI  During  a 
Missile  Development. 


Figure  7 shows  the  periods  of  reliability  growth  during  which  each  of 
the  two  priority  scales  should  be  used  predominantly.  As  can  be  seen,  the 
two  periods  overlap  considerably. 

OTHER  APPLICATIONS  OF  THE  PRIORITY  INDEX 

The  priority  index,  PI,  is  intended  to  be  a tool  to  be  used  mainly  by 
the  planning  reliability  co-ordinator  and  the  reliability  board.  However, 
some  useful  secondary  consequences  may  result,  such  as: 

Co-operat ion  Between  Designer  and  Reliability  Co- ordina  tor 

In  order  to  further  the  rapid  growth  of  the  over-all  reliability  it  is 
imperative  that  designer  and  reliability  co-ordinator  co-operate  intelli- 
gently and  thoroughly. 

The  reliability  co-ordinator  should  indoctrinate  the  designer  with  the 
facts  of  guided  missile  reliability  and  should  explain  to  him  the  nature 
and  purpose  of  the  priority  index.  The  designer,  in  turn,  must  be  willing 
and  even  anxious  tbdiscuss  with  the  reliability  co-ordinator  the  principles 
of  his  design  and,  in  particular,  the  weak  spots  he  may  suspect.  Mutual 
understanding  along  such  lines  will  have  two  very  favorable  consequences: 
First,  knowing  the  nature  of  the  priority  index,  the  designer  will  avoid 
undue  optimism  inestimating  the  probability  of  failure,  q'  of  the  component 
he  is  re spo  sible  for.  Second,  the  influence  of  the  cost  of  testing, 
N(a  + b)  + c,  on  the  priority  index  should  induce  the  designer  to  co-operate 
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with  the  reliability  co-ordinator  in  keeping  the  expenses  for  testing  as 
small  as  possible.  The  designer  will,  therefore,  not  insist,  particularly 
in  the  first  stages  of  development,  on  a comprehensive  test  program  that 
may  absorb  quite  an  unreasonable  share  of  the  limited  test  resourcss. 
Instead  he  will  insist  only  on  testing,  and  rapidly  improving,  the  most 
doubtful  parts  and  environments  of  his  component  and  he  will  co-operate  in 
finding  out  how  such  testing  can  be  furthered  most  quickly  and  economically. 


Co-operation  Be  tween  Contractor  and  Contracting  Agency 

Reliability  test  programs  will  oftentimes  require  considerable  support 
from  the  contracting  agencies,  particularly  when  severe  bottlenecks  in 
procurement  and  testing  cannot  be  overcome  by  the  limited  resources  of  the 
contractor.  In  such  cases  the  priority  index  submitted  to  the  contracting 
agency  may  help  with  important  decisions  on  such  matters  as  expanding  the 
contract,  granting  higher  priorities,  or  making  available  other  test 
resources  or  research  laboratories. 

The  ”Total  Hazard " of  Failure  Produced  by  a Component  Type 

Up  to  now,  the  hazard  of  failure,  H = m • q',  has  been  used  to  judge  the 
hazard  caused  by  a component  type  with  regard  to  only  one  particular  kind 
of  stress  or  environmental  condition.  This  was  called  a "test  case." 
Actually,  many  component  types,  particularly  the  sensitive  ones,  will  suffer 
from  several  (z)  kinds  of  stresses,  for  example,  shock,  vibration,  pressure, 
heat,  etc.,  thus  creating  z test  cases. 


Frequently  one  wil  1 want  to  know  the  risk  to  the  missile  that  may  be 
caused  by  a component  type  with  respect  to  a 1 1 environments  involved.  For 
this  purpose  one  simply  adds  up  the  z individual  hazards  of  failure,  and 
arrives  at  the  "total  hazard"  of  a component  type: 


*total  = «j  + F2  + K3  + 


r m(qj  + qj 


This  total  hazard,  will  be  of  considerable  value  in  judging  the 
degree  of  development  a component  type  has  attained.  In  particular,  it  will 
aid  in  sifting  out  those  component  types  that  require  intensified  scrutiny 
and  further  development,  or  those  that  need  to  be  replaced  by  better  types. 

St andardi zat ion  of  Guided  Missile  Components 

An  increasing  number  of  components  especially  developed  for  guided 
missiles  will  be  used  in  a variety  of  missile  types.  Such  components,  if 
they  are  still  unreliable,  may  require  centralized  sponsorship.  Upon  being 
fully  developed,  they  will  be  standardized. 
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In  determining  the  need  for  such  go ve r nmen t - s pon s o r e H development 
programs,  it  may  be  helpful  to  use  as  a scale  of  priority  the  "Grand  Haiard 
of  Failure,"  exerted  by  a component  type  upon  all  missile  types 
involved. 

If  several,  or  many,  such  urgent  component  programs  are  in  competition 
with  one  another,  and  if  the  testing  resources  are  limited  (which  is  usually 
the  case1),  it  is  recommended  that  a "Grand  Priority  Index,"  2PI  , be  used. 
This  will  show  which  of  the  various  programs  will  probably  contribute  mo  s t 
rapidly  and  most  effectively  to  the  reliability  growth  of  the  entire  guided 
missile  developnent  program. 

Thoroughness  of  Planning  Work 

One  may  object  to  the  use  of  such  priority  indices  on  the  basis  that 
they  are  too  cumbersome,  or  lead  possibly  to  ove ror gan i za t i on . 


The  actual  calculation  of  the  indices  is  only  a matter  of  minutes.  The 
real  difficulties  will  arise  when  the  basic  values  of  hazards  of  failure, 
m • q',  and  the  various  expense  factors,  N( a + b)  + c,  for  the  testing, 
are  to  be  determined.  However,  for  the  planning  and  conducting  of  a sound 
and  efficient  test  program,  these  values  must  be  calculated  and  collected 
anyway.  This  must  be  considered  as  one  of  the  main  tasks  of  the  reliability 
co-ordinator. 

Widespread  application  of  such  planning  indices  will  stimulate,  and 
often  enforce,  thoroughness  in  planning  work  that  has  as  its  salient 
objective  the  urgently  needed  rapid  growth  of  the  over-all  reliability  of 
guided  missiles 


★ ★ ★ 
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PART  III 


sampling  problems 

INTRODUCTION 

The  efficiency  of  a reliability  test  program  depends  greatly  on  the 
proper  choice  of  the  sample  s i ze  for  each  individual  test  case. 


Considerable  uncertainty  is  found  in  this  matter  Some  planners  have 
set  a goal  of  ICO  units  to  be  tested,  whereas  others  are  satisfied  with 
testing  only  one  unit  (or,  occasionally,  none).  As  a matter  of  feet,  no 
rules  that  are  generally  accepted  are  available  at  present. 

As  shown  in  Part  I,  the  sampling  problem  must  be  considered  in  the  light 
of  the  required  rapid  growth  of  the  over-all  reliability. 

For  this  discussion  three  main  categories  of  components  will  be  dis- 
t ingu i shed: 

1.  The  standardized  component  type. 

2.  The  newly  developed  component  type. 

3.  The  isolated  prototype. 

STANDARDIZED  COMPONENT  TYPES 

Standardized  components  must,  in  general,  be  viewed  with  suspicion, 
because  most  of  them  were  probably  developed  for  less  severe  environmental 
conditions  and  under  less  severe  specifications  for  reliability  than  prevail 
in  guided  missile  applications.  In  spite  of  this  they  have  three  great 
advantages  over  newly  developed  components: 

1.  They  have  already  reached  a certain  degree  of  perfection. 

2.  They  are  comparatively  inexpensive. 

3.  They  are  immediately  available  insufficient  numbers  for  reliability 
testing  and  can  therefore  contribute  to  the  growth  of  the  over-all  re- 
liability much  sooner  than  other  components. 

Standardized  components  can  therefore  he  considered  as  a great  asset 
in  the  reliability  development  of  a guided  missile  and  it  would  be  ideal  if 
one  could  build  a new  missile  type  mainly,  or  entirely,  with  standarized 
components.  Such  an  ideal  opportunity  will  of  course  never  occur.  It  is 
highly  desirable,  however,  that  in  the  n o t - t o o-d i s t an t future  a growing 
number  of  typical  guided  missile  components  will  become  standardized,  with 
well-known,  very  high  "strengths."* 

*S«*  WAMTC  Technical  Seports  No*.  7S  »nd  •*. 


The  Priority  Index,  PI  ^ — - — ♦ discussed  in  Part  II,  indicates 

clearly  that  most  of  the  standardized  components  should  be  selected  as  the 
first  subjects  for  reliability  testing,  because  they  occur  most  frequently 
in  a missile,  are  relatively  inexpensive,  and  are  readily  available  for 
test ing. 

There  is  another  reason  for  urgency  in  the  testing  of  standardized 
components:  Because  they  originate  in  mass  production  processes  that  are 
exceedingly  we  1 1 - t oo  1 ed  - up  and  inflexible,  even  minor  changes  in  design  rray 
cause  severe  disturbances  in  the  production  process.  The  general  reluctance 
of  manufacturers  to  agree  with  such  changes  is  understandable;  however, 
severe  setbacks  and  delays  in  the  growth  of  the  over-all  reliability  of  the 
missile  will  result  if  necessary  modifications  are  delayed. 

All  of  these  reasons  indicate  that  the  reliability  testing  of  the 


standardized  components  should  be  started  without  delay 


This  is  true  even  if,  in  the  early  stages  of  a missile  development,  the 
severity  of  some  of  the  e n v i r onmen t a 1 conditions  is  known  only  vaguely,  or 
not  at  all.  In  the  interest  of  rapid  growth  of  the  over-all  reliability  it 
is  highly  desirable  to  reveal,  as  early  as  feasible,  the  weakest  spots  of  a 
component  type  (see  figure  81 
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As  soon  as  the  stresses  are  also  determined,  for  example,  hy  flight 
testing  d ummy  missiles,  one  will  be  able  to  judge  without  further  delay 
whether  such  a "weak  spot"  is  acceptable  or  whether  serious  changes  indesign 
and  in  interferences  in  the  mass  production  process  are  unavoidably  required. 

The  early  knowledge  of  the  weak  spots  of  standardized  components  may,  in 
turn,  lead  to  the  decision  that  a critical  environmental  stress  must  be 
reduced  at  high  priority,  and  the  standardized  component  left  unchanged. 

Oftentimes,  when  such  "environment  testing"  results  in  oh  jec  t i oi\ab  le 
delay,  it  is  necessary  that  the  reliability  board  estimate  and  specify 
preliminarily  the  maximum  stresses  or  environments  to  which  a component  will 
probably  be  subjected  in  transportation,  storage,  and  service.  Such  an 
estimate  is  very  helpful  as  a modus  operandi  for  judging,  and  eliminating, 
the  most  obvious  weaknesses  of  a component  type  as  revealed  by  the  first 
t es t s - t o - f a i 1 u r e . As  soon  as  the  environments  become  better  known,  quick 
action  should  be  taken  to  modify  the  component  accordingly  or  to  reduce  the 
severity  of  environment,  if  feasible. 

" BEST”  SAMPLE  SIZES  FOR  STANDARDIZED  COMPONENTS 

With  regard  to  the  accuracy  of  a statistical  evaluation,  100  test  units 
are  preferable  to  25,  and  25  are  preferable  to  5,  of  course.  One  must 
realize,  however,  that  in  the  first  1 or  2 years  of  missile  development  a 
very  rapid  growth  of  the  over-all  reliability  should  be  striven  for.  In 
that  early  stage,  statistical  accuracy  is  of  minor  importance  because,  in 
any  event,  the  components  need  to  be  modified  step  by  step  until  they  are 
satisfactorily  adapted  and  reliable.  In  the  later  stages,  and  in  particular 
shortly  before  mass  production  is  to  be  ordered,  considerable  emphasis 
should  be  laid  on  statistical  accuracy,  which  will  necessitate  an  increase 
in  sample  sizes. 

No  rule  of  thumb  for  determining  the  "best"  sample  size  can  he  given 
because  each  of  the  hundreds  of  test' cases  must  be  studied  individually, 
and  hecause  considerable  engineering  judgment  is  required  in  reaching  a 
dec i s ion . 

Some  general  rules,  however,  can  be  derived  by  again  consulting  the 
formula  for  the  Priority  Index,  PI  = 

As  a first  approach  the  sample  size  should  be  so  chosen  that  a fairly 
reliable  statistical  result  can  be  expected,  for  example,  n : 20  or  25. 
This  tentative  sample  size  may  then  be  modified  step  by  s tep  by  the  following 
considerations: 

1.  If  the  expense  of  procuring  and  testing  a unit,  (a  + b),  is  small 
compared  to  the  expense,  c,  of  preparing  that  particular  test  program,  the 
initially  chosen  sample  size  should  be  increased,  and  vice  versa. 
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After  t lie  "best"  sample  size,  N,  lias  been  determined,  the  ultimate 
Priority  Index,  PI,  can  be  determined  for  each  test  case.  The  various 
c omponen t s " , ( i . e . , test  cases)  are  then  to  be  listed  in  t he  sequence  of 

their  Priority  Indices,  and  those  with  the  largest  indices  heing  put  first. 
Such  a list  will  he  Ip  tn  determine  the  ulti ma  te  test  priorities,  asdescri he  d 
on  page  18. 

NEWLY  DEVELOPED  COMPONENTS 

As  discussed  in  Part  I,  the  early  stages  of  a reliability  test  program 
will  exert  the  strongest  influence  on  the  success  or  failure  of  a flight 
test  program,  and  of  the  entire  missile  weapon  as  well.  Unfortunately  the 
number  of  units  produced  at  those  early  stages  will  oftentimes  be  too  small 
for  a proper  statistical  evaluation  of  the  test  results. 

In  such  cases  of  initial  scarcity,  the  rules  for  determining  the  best 
sample  size  should  he  used,  at  least  hypothetically  and  temporarily,  to 
arrive  at  Priority  Indices  that  emphasize  the  "weight"  of  the  various  "test 
cases"  for  the  reliability  test  program.  There  will  be  many  cases  for  which 
PI  turns  out  to  be  very  high.  Every  effort  should  then  be  made  to  produce 
the  required  number  of  test  units  as  quickly  as  feasible. 

THE  PROTOTYPE  UNIT 

Oftentimes  only  one  unit  of  a component  type  will  exist.  With  a single 
unit  no  reliability  test  program  can  of  course  be  conducted.  However,  in 
the  interest  cf  the  rapid  growth  of  the  over-all  reliability,  such  a 
component  must  be  tested  as  soon  as  feasible,  in  order  to  find  its  most 
critical  weaknesses,  at  least  tentatively  and  preliminarily.  It  would  be 
inexcusable  to  postpone  a critical  test  case  until  more  units  are  availa- 
b le  . Testing  of  one  unit  is  immensely  preferable  to  no  testing  at  all! 
Thus  the  first  prototype  unit  represents  the  most  valuable  unit  for  the 
whole  reliability  test  program,  even  if  it  does  not  exhibit  the  final 
configuration.  Consequently  a prototype  unit  should  never  be  expended  in  a 
flight  test  missile.  Such  misuse  may  in  many  cases  not  only  cause  an 
expensive  missile  to  fail,  but  may  also  delay  the  grovth  of  reliability  by 
the  time  interval  required  to  produce  a second  unit  for  the  test. 

It  should  be  stated  here  that  nonavai lahi I i ty  of  a component  for 
reliability  testing  must,  in  many  cases,  he  considered  as  an  indication  of 
poor  judgment  and  organization.  This  holds  particularly  true  when  such  a 
component  type  is  going  to  he  used  in  expensive  flight  test  missiles. 

A designer  may  be  reluctant  to  permit  his  prototype  to  be  tested  to 
failure,  i.e.,  to  permit  it  to  be  destroyed.  Such  reluctance  may  occasionly 
be  justified,  hut  not  in  the  majority  of  the  cases.  As  a general  rule,  a 
second  and  third  unit  should  be  at  hand  for  the  failure  testing  immediately 
after  the  system  testing  of  the  nrototype  has  more  or  less  proved  its 
adequacy  for  the  design  purposes.* 

* Subcontractors  who  have  not  at  yet  been  concerned  with  guided  missile  components,  and  who  are 
therefore  unaware  of  the  difficult  reliability  problem,  will  most  probably  object  to  such  haste. 
To  secure  the  intelligent  co-operation  of  the  subcontractors,  it  is  imperative  that  they  be 
sufficiently  indoctrinated.  This  indoctrination  is  an  important  task  of  the  reliability  co- 
ordinator. 
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OBTAINING  MAXIMUM  INFORMATION  FROM  AN  ISOLATED  (PROTOTYPE)  UNIT 
Single  Environmental  Condition 

Fortunately  most  of  the  components  of  a guided  missile  actually  suffer 
from  only  one  kind  of  stress  or  environmental  condition.  In  such  cases  it 
is  necessary  to  concentrate  on  the  part  or  lofcation  (e.g.  , cross  section) 
which,  under  increasingly  severe  stress  will  always  fail  first. 

If  the  first  test  proves  that  the  "strength"  is  very  much  above  the 
maximum  stress  ( for  example,  three  times  as  high  or  higher),  testing  may  be 
discontinued  preliminarily,  and  even  permartently  in  cases  of  extreme 
strength. 

If  the  first  test  reveals  a strength  close  to  the  maximum  stress,  more 
units  must  i mmed iately  he  ordered  for  continuing  the  tests.  These  subsequent 
units,  however,  should  he  reinforced,  or  otherwise  improved,  before  con- 
tinuing with  the  testing.  In  all  such  cases  one  should  see  whether  the 
maximum  stress  or  environmental  condition  can  be  greatly  reduced.*  Such 
reduction  is  of  particular  value  because,  in  many  instances,  not  only  one 
component  but  many  components  will  be  improved  relatively,  i.e.,  become 
more  reliable  without  modification. 


Multiple  Independent  Environmental  Conditions 


For  components  that  are  being  subjected  to  several  independent  environ- 
mental conditions,  one  must  try  to  anticipate,  before  testing,  which 
conditions  may  be  the  most  adverse.  The  next  step  is  to  find  out  which  of 
the  tests  are  the  least  destructive.  These  tests  should  be  made  first,  if 
they  are  not  too  time  consuming. 


Example:  A component  may  be  subjected  to: 


1.  Shock 

2.  Cold 

3.  Vibration 
4 . Du  s t 


(■destructive) 
(nondest  ruct ive  ) 
(very  destructive) 
( nonde  structive) 


For  obtaining  maximum  information  from  the  one  prototype  unit,  the  test 
program  should  be  conducted  in  the  sequence: 


1. 

Dust 

(nondestructive) 

2. 

Cold 

(nonde  structive) 

4 • 

Shock 

(destructive) 

4 . 

Vibration 

(very  destructive) 

*See  NAMTC  Technics!  Report  No.  75,  pa(e  33,  point  4, 
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After  the  tests  one  will  know  much  better  which  of  the  environments  are 
really  impa  i r ing  the  reliability,  and  which  are  harmless.  After  the 
predominant  causes  of  failures  have  been  detected,  the  testing  should  he 
concentrated  on  those  critical  environmental  conditions 

If  the  prototype  is  destroyed,  for  example,  by  shock,  one  will  try  to 
repair  it  for  use  in  the  destructive  vibration  test.  It  may  even  be 
feasible  to  repair  a component  repeatedly  before  it  becomes  entirely  useless 
for  further  testing.  Before  repair  eventually  becomes  impossible,  more 
units  must  be  quickly  produced. 

By  this  method  one  can  rapidly  discover  theweakest  parts,  or  properties, 
of  a component  type,  even  though  only  one  unit  is  available.  A large 
proportion  of  components  can  thus  be  improved  in  the  first  stages  of  their 
de  ve 1 opme  n t . 


The  test  results  obtained  in  this  manner  are  of  course  not  the  basis 
for  judging  the  reliability  conclusively,  nor  for  far-reaching  decisions, 
such  as  the  o rd e r i n g of  ma s s pr od uc t i on  o f a c omponen t type.  The  reliability 
testing  must  be  resumed  as  soon  as  more  units  become  available  for  testing. 
In  the  meantime  one  should  try  to  increase  his  knowledge  of  the  environmental 
conditions  in  order  to  provide  a basis  for  evaluating  the  reliability. 


Multiple  Interdependent  Environmental  Conditions 

This  problem  was  discussed  in  NAMTC  Techincal  Report  No.  84.  The  most 
significant  conclusions  are  reprinted  here: 

"With  increasing  numbers  of  interacting  critical  conditions,  it 
will  become  increasingly  difficult,  time-consuming,  and  costly  to 
test  the  significant  st r es s - s t rength  combinations  and  to  evaluate 
their  probability  of  failure.  Such  cases  may  indicate  that  the 
component  in  question  is  so  complex  that  it  has  but  little  chance 
of  becoming  serviceable  in  time.  Insufficient  response  to  testing 
methods  should  be  considered  as  a strong  indication  of  not  only 
great  immaturity,  but  faulty  development  as  well." 

"In  this  connection  it  cannot  be  too  strongly  emphasized  that 
complex  components  which  are  difficult  to  evaluate  and  to  develop 
by  ground-testing  are  by  far  more  difficult  or  even  impossible  to 
develop  to  reliability  by  f 1 i gh t - t e s t i n g . " 

Testing  of  components  under  multiple  interdependent  environments  will 
require  considerably  larger  numbers  of  test  units  than  the  more  simple 
cases  discussed  in  the  two  preceding  sections,  i.e.,  single  environmental 
condition  and  multiple  independent  environmental  conditions.  The  volume 
and  complexity  of  testing  will  also  be  considerably  larger.  For  these 
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reasons  most  of  the  newly  developed  ve r v complex  components  can  he  tested 
for  reliability  only  after  the  later  stages  of  the  development'  are  reached. 
As  a consequence  the  newly  developed  complex  components  will  always  repre- 
sent the  worst  liabilities  of  a missile  development.  One  such  component, 
or  system  can  easily  prevent  the  success  of  a guided  missile  type.  Great 
caution  and  skepticism  are  therefore  required  in  estimating  the  chances  of 
making  such  components  mature  and  reliable  in  due  time.  In  many  cases  it 
may  be  advisable  to  develop  a second,  or  even  a third,  solution  simultane- 
ous ly . 

The  be  st  method  for  avoiding  such  liabilities,  howe  ve  r,  lies  in  striving 
for  utmost  simplicity  in  design. 

In  this  connection  it  should  he  pointed  out  that  the  testing  of  com- 
ponents for  complete  missiles')  under  multiple  environmental  conditions  can 
be  greatly  expedited  by  proper  test  planning.  It  would  be  very  desirable 
to  have  the  aid  of  a good  statistician,  well  versed  in  the  analysis  of 
variance,  in  regression,  and  in  other  methods  of  increasing  the  efficiency 
and  significance  of  the  test  process. 

PREFLIGHT  TESTING  OF  COMPLETE  FLIGHT  TEST  MISSILES 

In  the  preceding  chapters  the  problem  of  testing  and  sampling  of  guided 
missile  components  is  discussed  from  the  standpoint  of  how  readily  the 
various  component  types  are  available  for  testing,  how  easily  they  can  be 
tested  "up  to  failure,"  and  how  weak  and  doubtful  they  are. 

According  to  the  concepts  advocated  in  NAMTC  Technical  Reports  No.  75 
and  No.  84.  all  components  that  may  be  critical  to  a guided  missile  type 
should  be  subjected  to  the  important,  or  critical  environmental  conditions, 
but  at  intensities  several  times  more  severe  than  in  service,  in  order 
to  find  out  at  what  intensity  the  device  will  fail,  i.e.,  "the  ultimate 
strength."  The  safety  margin  between  service  loading  and  failure  loading 
is  then  examined  to  see  whether  such  safety  margins  are  adequate  in  view  of 
the  variability  of  service  conditions  and  reproducibility  of  the  component 
in  question. 

The  importance  of  this  philosophy  will  increase,  the  more  closely  the 
critical  phase  of  early  mass  production  is  approached.  At  that  stage  one 
must  know  n ume  rica 1 1 y what  the  service  environments  really  are  and  what 
severity  of  stresses  the  various  components  are  capable  of  sustaining 
without  failure.  No  component  type  should  go  into  mass  production  that  is 
still  marginal  and  hazardous  to  the  missile  weapon. 

There  is,  however,  another  very  important  aspect  of  the  reliability 
problem:  How  shall  one  handle  a complete  test  missile  that  consists  of 
many  components,  the  individual  reliabilities  of  which  are,  at  that  stage, 
unknown’  Shall  such  a test  missile  be  withheld  from  firing  until  all  or 
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most  of  the  pertinent  up- t o- f a i 1 ure  tests  have  been  satisfactorily  completed’ 
Or  should  the  manifold  risk  of  a failure  of  such  an  expensive  test  missile 
be  taken’ 

There  are  two  alternatives  to  be  considered.  Assuming  first,  that  only 
one  particular  doubtful  component  is  to  be  used  in  the  firing  of  a fully 
deve loped  missile,  should  the  risk  of  a missile  failure  not  be  taken  just 
because  that  weak  component  will  possibly  fail? 

In  this  case  one  might  be  satisfied  with  the  evidence  that  the  component 
in  question  shows  a high  probability  of  surviving  this  test  flight.  It  is 
not  necessary  to  ground  test  any  other  unit  but  this  one,  nor  is  it  necessary 
to  test  it  up  to  failure  and  possibly  to  destruction.  It  will  frequently 
suffice  to  test  it  up  to  a severity  of  the  most  critical  condition  for 
conditions)  that  is  well  above  the  condition  of  flight.*  Whether  optimism 
or  pessimism  is  the  proper  attitude  in  such  a case  depends  largely  on  the 

particular  situation  produced  by  many  circumstances  such  as  the  doubtful- 
ness of  the  component  in  question,  the  cost  of  the  missile,  the  urgency  of 
the  firing  within  the  schedules  of  the  development,  the  availability  of  more 
missiles  for  continuing  the  test,  the  program  importance  of  the  particular 
missile  type , etc. 


The  second  alternative  is  the  case  of  a test  missile  that  may  contain 
not  only  one,  or  two,  but  a great  many  doubtful  components.  In  such  cases, 
particularly  if  the  missile  is  expensive,  the  decision  whether  the  missile 
should  or  should  not  be  fired  is  very  difficult  to  make. 

The  most  logical  method  seems  to  be  to  subject  the  whole  test  missile 
to  the  specified  environmental  "test  values"  and  to  prevent  the  firing  of 
missiles  that  fail,  until  an  assembly  that  will  pass  the  test  schedule  is 
for  thcoming  . 

"Unde r t e s t i n g"  and  "overtesting"  are  two  serious  risks  encountered  in 
the  use  of  this  method.  Undertes  ting,  i.e.,  testing  at  conditions  milder 
than  those  occuring  in  flight,  does  not  help  to  detect  all  of  the  "weak" 
c omponen  t s,  and  may  therefore  result  in  failure  of  the  missile.  Ove  rtesting, 
i.e.,  testing  at  too  severe  conditions  or  for  too  long  a tisse,  may  bring 
one,  or  many,  components  to  the  verge  of  failure  and  thus  cause  the  very 
missile  failure  that  should  have  been  prevented  by  the  test  method. 


Whether  a given  test  condition  is  too  mild  or  too  severe  is  very 
difficult  to  decide.  Depending  on  the  background,  attitude,  and  interest 

of  many  people,  each  concerned  with  the  survival  of  their  particular 
component,  opinions  about  what  test  severity  would  constitute  the  "best" 
compromise  will  always  differ  greatly.  This  situation  is  made  even  more 
*Thia  statement  i«  not  incompatible  with  the  concept!  diicuised  in  Chapter  5.  It  if  of  course 
highly  prefersble  and  reassuring  to  know  (from  up-t o- f s i lure  testing)  the  maximum  strength  of  a 
component  type  before  the  missile  is  to  be  fired.  Occasionally  this  up- t o- f s i I ure  testing  is  not 
feasible  and  oftentimes  too  late  rscognlsed  as  being  necessary. 
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difficult  by  the  fact  that  not  one  but  several  environmental  conditions 
must  be  considered,  and  these  conditions  are  frequently  interdependent  and 
often  only  vaguely  known. 


Thus  the  latitude  between  the  risks  of  undertesting  and  overtesting  a 
missile  may  often  be  rather  small.  Consequently,  the  responsibility  for 
taking  the  risk  of  a "very  doubtful"  (and  possibly  very  expensive)  test 
firing  is  largely  shifted  from  the  designers  and  manufacturers  to  those 
persons  who  must  ultimately  specify  the  severities  of  the  various  kinds  of 
environmental  preflight  tests.  These  persons  may  often  be  put  in  a rather 
difficult  position. 

Nevertheless  it  would  be  highly  desirable  to  develop  rational  environ- 
mental test  methods  for  complete  missiles,  in  order  to  expedite  flight  test 
programs.  The  discussion  of  this  problem,  however,  does  not  lie  within  the 
scope  of  this  study. 


★ ★ ★ 
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problems  of  organization 


GENERAL 

The  re  1 i ab i 1 i t y o f any  ordinary  complex  technical  apparatus  (automobiles, 
aircraft,  etc.)  must  essentially  he  designed  into  it.  However,  the  final 
growth  of  the  reliability  to  the  required  level  can  be  accomplished  only  by 
testing  a great  many  units  under  service  conditions  and  by  current  sta- 
tistical evaluation  of  the  failures  that  occur  during  actual  service  use. 
Inadequacies  and  failures  are  ordinarily  detected  quickly  and  are  easily 
traced  to  their  basic  cause,  and  this  leads  to  their  elimination  as  po- 
tential hazards.  Thus  one  can  say  that, paradoxic  as  it  seems,  f ai  lure  s are 
essential  and  instrumental  to  the  achievement  ui  the  ultimate  level  of 
reliability. 

Unfortunately  the  reliability  of  guided  missiles  can  rarely  profit  from 
failures  in  flight  testing  and  service  use  because  it  is  very  difficult  to 
trace  failures  in  flight  to  their  basic  causes  and  origins.  In  one  evalu- 
ation of  a considerable  number  of  failures  of  flight  test  missiles,  it  was 
found  that,  on  the  average,  the  cause  of  a failure  in  flight  can  be  traced  not 
much  further  than  to  the  s ys  te  in  (guidance,  propulsion,  airframe,  etc.)  that 
by  its  malfunction,  has  caused  the  missile  to  fail.  The  statistical 
evaluation  of  the  "Efficiency  of  Tracing"  of  the  causes  of  these  flight 
failures  is  very  significant.  In  a particular  study  of  this  point  it  was 
found  that: 


8 per  cent  could  not  be  traced  at  all. 

44  per  cent  could  be  traced  to  the  system. 

28  per  cent  could  be  traced  to  the  component. 

14  per  cent  could  be  traced  to  the  element. 

6 per  cent  could  be  traced  to  the  basic  cause. 

Thus  only  6 per  cent  of  the  failures  in  flight  led  to  the  elimination  of 
the  responsible  "ailments"  of  the  missile  type. 


Even  if  one  assumes  that  the  techniques  for  tracing  the  causes  of 
flight  failures  will  steadily  be  improved,  one  should  realize  that  failures 
of  guided  missiles  in  flight  can  never  produce  sufficient  information  to 
bring  about  the  urgently  needed  growth  of  the  over-all  reliability.  Other 
methods  and  means  must  be  developed  instead,  such  as  comprehensive  scrutiny 
of  all  component  types  involved  and  by  testing  these  components  "up  to 
failure"  in  order  to  reveal  their  maximum  strengths  and  their  safety  margins 
relative  to  all  environmental  conditions. 
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As  discussed  in  Part  I,  this  is  a task  of  great  difficulty  and  extreme 
responsibility.  To  accomplish  it  satisfactorily  it  is  necessary  that  all 
conceivable  methods  and  means  of  oreani ;n t i on  that  may  help  to  f urther  the 
growth  or  reliability  be  thoroughly  studied  and  freely  applied. 

The  author  realizes  that,  at  the  present,  discussion  of  these  matters 
is  highly  controversial.  However,  the  precariousness  of  the  reliability 
situation  of  guided  missiles  demands  that  not  only  the  theoretical  but  also 
the  organizational  prohlems  be  attacked  without  delay.  As  the  scope  of 
experience  enlarges,  these  concepts  of  organization  will  be  improved,  or 
replaced  by  better  ones,  until  firm  ground  is  reached. 

MEANS  OF  HANDLING  RELIABILITY  DATA 
The  List  of  Components 

The  first  step  in  a reliability  test  program  consists  of  preparing  and 
keeping  a complete  and  very  detailed  list  of  all  the  component  types  that 
could  become  hazards  to  the  missile. 

It  is  customary  to  build  up  such  component  lists  as  the  development  of 
a missile  is  progressing.  However,  these  lists  come,  in  general,  much  too 
late  for  the  requirements  of  a reliability  co-ordinator,  who  should  always 
keep  abreast  of,  or  preferably  be  ahead  of,  a missile  development,  as  far 
as  reliability  is  concerned.  Moreover  such  lists  are  not  set  up  to  contain 
the  specific  information  necessary  in  the  scrutiny  of  the  reliability  of  a 
guided  missile. 

A suggestion  for  a component  list  is  shown  in  Table  1: 


LIST  OF  COMPONENTS 


MISSILE  TYPE  WASP  H 
SYSTEM  POWER  SUPPLY 


POS. 

NO. 

UNITS 

PER 

MISSILE 

COMPONENT  TYPE 
ORIGINATING  FIRM 

EXPERTS 

UNITS 
AVAILABLE 
FOR  TESTS 

UNITS 

ON 

ORDER 

DATE  OF 
DELIVERY 

REMARKS 

URGENCY 

OF 

TESTING 

1 

25 

AMPLIFIER,  TYPE  X-5 
GRIDLEY,  BOSTON 

SMITH 

JONES 

5 

20 

3/15/52 

NO  RELIABILITY  TESTS  PERFORMED 
CONFERENCE  2/5/52 

XXX 

2 

1 

MASTERSWITCH  R/6 
WESTINGHOUSE 

SMITH 

MILLER 

' 

15 

4/28/52 

RELIABILITY  DATA  REQUESTED 
FROM  VENDOR  LETTER  1/14/52 

X 

34  ; RESTRICTED 


RESTRICTED 


Among  the  various  items  to  he  listed,  the  names  of  experts  deserve 
particular  attention.  From  the  very  beginning  of  a development,  the 
reliability  co-ordinator  should  attempt  to  learn  the  names  of  the  foremost 
men  and  specialists,  of  his  own  firm  as  well  as  those  of  the  originating 
firm,  who  can  and  are  willing  to  co-operate  with  him  in  the  matter  of 
reliability.  Close  personal  contact  between  the  reliability  co-ordinator 
and  these  experts  in  design,  production,  and  quality  control  is  essential 
if  delays  in  the  growth  of  reliability  are  to  be  avoided.  Such  delays 
might  easily  accumulate  to  years. 

These  specialists  should  be  indoctrinated  as  soon  as  feasible  in  matters 
of  reliability  peculiar  to  guided  missiles.  This  again  js  a very  specific 
task  of  the  reliability  co-ordinator. 

The  List  of  Stresses  and  Environments I Conditions 

At  the  beginning  of  a development  most  of  the  main  stresses  and  environ- 
mental conditions  can  be  anticipated  only  vaguely.  However,  to  provide  a 
basis  for  an  early  appraisal  of  the  standardized  components  to  be  used  and 
a basis  for  the  development  of  new  components,  one  ought  to  de  termine  the 
most  important  stresses  and  conditions  tentatively,  preliminarily,  and 
conservative ly.  Such  prognostication  must  be  done  by  the  specialists 
responsible  for  the  various  fields  of  design  and  hy  those  responsible  for 
the  specifications. 

To  avoid  undue  optimism,  it  is  essential  that  these  specialists  become 
well  acquainted  wi  th  the  precarious  reliability  situationof  guided  missiles. 

The  importance  of  such  pre 1 iminary  specifications  for  the  reliability 
progress  of  a guided  missile  cannot  be  overemphasized.  They  should  there- 
fore be  under  the  control  of  the  Reliability  Board.* 

As  the  development  progresses,  the  environments  will  become  better 
known  and  the  list  will  need  to  be  revised  step  by  step. 

Such  clerical  work,  however,  is  not  all  that  should  be  done  by  the 
reliability  co-ordinator.  Whenever  a stress  or  condition  is  found  to  be 
more  severe  than  anticipated,  or  whenever  a new  kind  of  stress  or  environ- 
mental condition  is  detected  (such  setbacks  are  unavoidable),  the  relative 
reliability  of  some,  occasionally  of  hundreds,  of  components  may  be  criti- 
cally lowered.  It  is  very  much  in  the  interest  of  the  rapid  growth  of  the 
over-all  reliability  that  quick  action  should  be  taken,  such  as:  the 

relaying  of  new  facts  to  all  internal  and  external  activities  involved, 
discussion  of  the  technical  and  contractual  requirements  for  adapting 
a component  type  to  the  new  condition,  planning  of  the  procurement  of 
improved  units  for  reliability  testing  and  flight  testing,  and  supervising 
the  new  schedules  of  delivery. 

* Se e dlicuuioni  on  Reliability  Board  in  NAMTC  Technical  Reporta  Noa.  75  and  84. 
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Such  actions  of  co-ordination  require  a superior  insight  into  the 
present  and  future  reliability  situation  of  the  missile,  a strong  sense  of 
responsibility,  a considerable  organizational  ability  and  initiative,  and 
close  personal  contact  with  all  specialists  of  development  and  all  relia- 
bility co-ordinators  at  the  vendors’  establishments.  The  reliability 
co-ordinator  is  expected  to  possess  all  of  these  qualifications.  It  is 
recommended  that  he  and  his  staff*  be  charged  with  this  organizational  task. 

The  " Plan  of  Survey . " 

By  combining  the  "List  of  Components"  with  the  "List  of  Stresses  and 
Env i ronments"  a clear  view  of  the  many  hazards  to  the  missile  is  achieved. 
These  hazards  can  best  be  presented  (Table  2 ) in  the  form  of  a "Plan  of 
Survey."  as  suggested  in  NAMTC  Technical  Report  No.  75- 

Such  a plan  will  be  particularly  useful  at  the  beginning  of  a missile 
development.  At  that  time  a tentative  and  preliminary  distinction  should 
be  made  between  combinations  that  are  possibly  critical  (XXX),  important 
(XXI,  to  be  considered  (X),  or  not  involved  ( - ) . 

The  Card  File  of  Hazards 

In  the  later  stages  of  a missile  development,  more  highly  detailed  data 
will  be  required  for  scrutiny  and  for  planning  and  conducting  a reliability 
test  program.  For  this  purpose  a "Card  File  of  Hazards"  is  suggested. 
Here  one  should  find  all  essential  data  for  each  component  type,  such  as: 

1.  Origin  of  design;  name  of  firm  and  expert  designer. 

2.  Manufacturer;  names  of  expert  for  production,  and  of  inspector. 

3 . All  critical  stresses  and  environmental  conditions. 

4.  Safety  margins;  specified,  K 

5.  Safety  margins;  attained,  k. 

6.  Index  of  probability  of  failure,  q'. 

7.  Frequency  of  occurence  in  the  missile,  m. 

8.  Hazard  of  failure,  m’q'. 

9.  Number  of  test  units,  N,  required  at  various  stages  of  the  program. 

10.  Cost  for  one  unit  (a). 

11.  Cost  of  one  test  (b). 

12.  Cost  for  preparing  the  test  (c). 

13.  Priority  Index,  PI. 

14 . Tes  t Priority. 

15.  Test  activity;  name  of  laboratory  and  of  responsible  person. 

16.  Date  of  beginning  of  tests. 

17.  Date  of  completion  of  tests. 

18.  State  of  development  (survey,  maturity). 

19.  State  of  production. 

*Th<  organization  of  the  reliability  ataff  will  be  diacueied  later  in  this  study. 
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Depending  on  the  complexityof  a component  and  on  the  number  of  critical 
envir on me  n t a 1 c ond  itions,  each  c omp  onen  t t ype  will  require  several,  or  many, 
subcards.  The  file  of  a complex  missile  will  therefore  grow  quite  large; 
consequently,  all  means  should  be  used  to  emphasize  and  bring  to  attention 
t he  mo st  critical  hazards,  ( i . e . , through  the  use  of  file  tabs  of  various 
colors') 

List  of  Test  Results  and  the  Reliability  Chart 

As  a reliability  test  program  grows  it  will  yield  the  reliability  data 
of  an  increasing  number  of  component  types  relative  to  the  various  critical 
conditions.  Such  data  are: 

1.  The  "reliability  index,"  p’*. 

2.  The  "hazard  of  failure,"  H — m * q***  ( relative  to  one  particular 

c ond i t i on ) . 

3.  The  "total  hazard  of  failure,"  Ptotai  = m * q*  ( relative  to  all 
critical  conditions  involved). 


A separate  list  should  be  kept  for  each  of  the  main  systems.  This  list 
should  include  all  components  of  the  system  and  should  show  the  data*** 
mentioned  in  the  preceding  section. 


The  purpose  of  these  system  lists  is  to  bring  out  as  early  as  possible, 
the  total  hazard  of  failure  generated  by  each  of  the  systems,  and  by  each 
individual  component  type  within  a system,  and  to  help  to  decide  which 
systems  need  intensified  development  and  which  should,  as  soon  as  possible, 
be  replaced  by  better  systems  or  types. 

As  these  lists  become  more  and  more  extensive  and  complete,  the  relia- 
bility co-ordinator  will  carry  over  the  hazards,  m ‘q*,  on  to  a master  list, 
in  the  order  of  their  magnitude,  and  plot  the  data  from  the  lists  in  one  of 
the  "Reliability  Charts"  suggested  in  NAMTC  Technical  Report  No.  75,  Part 
III.  Thus,  pictures  of  the  over-all  reliability  situation  of  the  current 
stages  of  development  will  be  available  that  wil.l  show,  for  example; 

The  total  number  of  scrutinized  components  and  conditions. 

The  number  of  doubtful  components  that  have  not  yet  been  tested  or 
evaluated  for  reliability. 

The  number  of  "erratic"  components. 

The  index  of  the  over-all  reliability. 


*Diacuaaed  in  NAMTC  Technical  Report  No.  84,  P«ge  46. 
**Diicueaed  on  page  16* 

***  See  NAMTC  Technical  Report  N°.  75,  Liat  II,  page  60. 
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The  "Pom  ter  of  Erratics " 

As  a reliability  test  progrnir  gets  unde  r way,  more  and  more  comb  inat  ions 
of  components  and  environments  will  be  revealed  as  particularly  hazardous 
to  the  missile.  Such  combinations,  outlined  in  NAMTC  Technical  Report  No. 
75,  may  be  called  "Erratic. * These  should  be  strongly  emphasized,  not  only 
in  the  card  file  and  in  the  lists,  but  also  on  a special  " Pos  ter  of  Erratics,® 
set  up  in  the  office  of  the  reliability  co-ordinator. 

These  posters  should  show  at  a glance  the  most  critical  hazards  and  the 
most  pertinent  data,  such  as  the  probability  of  failure,  q*;  the  frequency 
of  occurrence,  m;  the  hazard  of  failure,  m * q ' ; the  total  hazard  of  failure, 
£m  * q';  schedules  for  further  testing;  severe  bottlenecks;  etc. 

As  some  of  these  critical  difficulties  are  overcome,  their  listings  can 
be  omitted  from  the  poster  of  erratics.  New  cases  will  occur  that  need  to 
be  posted.  Thus,  for  the  sake  of  flexibility,  one  could  write  the  essential 
data  on  separate  paoer  inserts  that  could  easily  be  changed  or  removed. 
Various  colors  would  help  to  emphasize  the  most  critical  items. 

Such  a poster,  by  its  mere  existence,  will  emphasize  the  most  alarming 
hazards  and  stimulate  action  on  the  part  of  those  concerned. 


ESTABLISHMENT  OF  A RELIABILITY  GROUP 

Offhand  consideration  may  lead  to  the  assumption  that  the  development  of 
the  reliability  of  guided  missiles  belongs  essentially  in  the  realm  of  the 
well-established  organization  of  inspection  and  quality  control  and  that 
therefore  a separate  organization  for  taking  care  of  the  reliability  would 
not  be  necessary.  That  this  is  not  true  can  be  seen  by  considering  the 
specific  tasks  of  the  reliability  grouo,  as  conceived  in  this  study: 

1.  Making  preliminary  estimates  concerning  a new  guided  missile  project, 
with  reference  to  the  over-all  reliability  achievable. 

2.  Indoctrinating  all  des  igners  and  research  wo  rk  e rs,  within  and  outside 
the  plant,  concerning  facts,  methods,  and  tools  for  achieving  reliability. 

3.  Improving  existing  methods  and  tools  and  developing  new  ones  for 
achieving  high  reliability. 

4.  Establishing  a rigid  scrutiny  of  all  conceivable  hazards  of  failure 
by  keeping  and  evaluating  lists,  tables,  charts,  etc. 

5.  Initiating,  supervising,  and  evaluating  reliability  tests  that  are 
necessary  for  sifting  out  , impr  oving,  or  rejecting  unreliable  c ompone  n t t y pe  s . 

6.  Planning  and  supervising  the  study  (with  the  aid  of  experts  in  all 
fields  concerned)  of  all  stresses  and  environmental  conditions  that  may 
impair  reliability. 

7.  Planning  and  supervising  the  study  (with  the  aid  of  experts  in  ill 
fields  concerned)  of  the  specifications,  in  particular  of  the  safety  margins 
that  are  to  be  specified,  and  revised. 
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8.  Keeping  close  personal  contact  with  all  vendors  in  order  to  secure 
an  adequately  high  reliability  in  all  their  designs. 

9.  Keeping  close  personal  contact  with  the  organizations  qf  quality 
control,  flight  testing,  logistics,  and  field  operations,  for  the  purpose 
of  collecting  all  available  facts  about  doubtful  components  and  conditions 
that  need  to  be  scrutinized. 

10.  Determining  the  Priority  Indices  for  test  programs. 

11.  Indoctrinating  military  instructors. 

12.  Supervising  and  evaluating  all  logistics  with  regard  t o re  1 jab i 1 i ty . 

13.  Co-operating  with  the  fleet  during  troop  training  and  ser  ice  use, 
for  detecting  and  evaluating  mo  re  hazards  and  failures;  co-operating  in  the 
writing  of  RUDM's  (Reports  of  Unsatisfactory  or  Defective  Material'll  and  in 
initiating  quick  action  for  retesting,  improvements,  or  rejection.* 

The  reader  may  judge  for  himself  which  of  these  tasks  could  be  taken 
over  by  the  organizations  of  inspection  and  of  statistical  quality  control 
as  they  now  exist  within  the  firms. 

The  organizational  problem  may  be  further  clarified  by  the  following 
considerat ions: 

1.  One  of  the  main  objectives  of  statistical  quality  control  is  the 
finding  of  an  optimum  compromise  between  quality  on  the  one  hand  and  cost 
of  production,  inspection,  repair,  or  rejection  on  the  other  hand.  Such 
compromises  vary  greatly  from  case  to  case,  yet  their  order  of  magnitude  is 
illustrated  by  typical  specifications  like  this:  "A  lot  is  accepted  if  the 

sample  does  not  contain  more  than  1 (or  2,  or  S')  per  cent  defectives." 

Such  scales  of  "quality"  have  proved  to  be  quite  satisfactory  for 
practically  all  fields  of  technique  - except  guided  missiles.  For  guided 
missiles  they  are  not  only  inadequate  but  even  ruinous,  because  of  the  known 
" 1 inks - o f - a - c ha  i n"  character  of  the  operation  of  components  in  a missile, 
and  because  missiles  are  not  recoverable  for  postflight  inspection. 

This  situation  may  be  illustrated  by  two  hypothetical  examples: 

In  an  aircraft,  the  receiver  ceases  to  operate.  The  cause,  failure  of  a 
vacuum,  tube,  will  immediately  be  recogniied  by  the  crew.  After  the  aircraft 
has  landed,  the  basic  cause,  within  the  tube,  can  be  determined  with  certain- 
tity  by  the  ground  crew.  Replacement  of  the  tube  may  take  a few  minutes  and 
may  cost  a few  dollars.  After  replacement  of  the  tube,  the  aircraft  receiver 
is  perfectly  operable  again. 

*It  it  obvious  that  thf  reliability  group  hai  to  perform  many  typical  tasks  of  "co-ordination": 
co-ordination  of  strassas,  safety  margins,  and  strengths  for  all  cosiponants  and  anv  ir  onsiant  s J 
co-ordination  of  research  engineers,  designers,  msnuf act ura rs , operators,  srith  respect  to  relia- 
bility: co-ordination  of  contracting  agencies,  contractors,  subcontractors,  srith  respect  to  relia- 
bility: co-ordination  of  teat  prioritlaa:  co-ordination  of  the  probabilities  of  failure  of  all 

components  (scrutiny). 

Consequently  the  title  of  "Reliability  Co-ord lnetor"  seams  to  bs  not  only  s ppr opr  is t a but 
necessary  to  dealgnata  those  whose  job  it  is  to  perform  such  difficult  and  thankless  tasks, 
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In  a guided  missile,  the  failure  of  a vacuum  tube  will  unavoidably  cause 
the  loss  of  an  entire  "firing"  which,  including  all  operational  expenses, 
may  represent  a loss  of  $100,000  or  more  and  may  possibly  mean  penetration 
by  an  enemy  bomber  with  catastrophic  consequences.  Tomake  things  worse,  it 
is  probably  almost  impossible  in  flight  to  identify  the  tube  as  the  real 
cause  of  the  missile  failure,  let  alone  to  diagnose  the  basic  cause  of  the 
failure  within  the  tube.  Such  diagonsis,  however,  is  i nde s pe n s ab 1 e as  a 
basis  for  the  prevention  of  future  missile  failures  from  the  same  cause. 

It  may  be  a long  time  before  such  bitter  facts  are  thoroughly  recognized 
and  appreciated  by  all  those  concerned  with  the  development,  ma nu f ac t u r i n g , 
and  operation  of  guided  missiles  and  their  components. 

2.  The  advocates  of  modern  quality  control  frequently  complain  that  the 
principles  of  quality  control  are  fully  appreciated  and  applied  only  by  the 
larger  and  more  quality-conscious  firms.  For  instance,  the  Niagara  Frontier 
Division  of  Bell  Aircraft  Cornoration  analyzed  acceptance  and  rejection 
records  covering  nearly  35  million  parts  purchased  from  458  companies.* 


Only  1 . 

95  per  cent 

of  these 

parts 

were  found  defective  and  rejec 

ted  . 

But  i t 

was  found  that : 

277 

oompanie s 

supp 1 ied 

pa  r t s 

0 

to  1.99 

per  cent 

de  f ec  t i ve  . 

39 

c ompan i e s 

suppl ied 

parts 

2 

to  4.99 

per  cent 

defective. 

31 

companies 

s upp  lied 

parts 

5 

to  9.99 

per  cent 

defective. 

44 

compa  nie s 

supp  lied 

parts 

10 

to  19. 

99  per  cent  defective 

• 

36 

c o mp  a n i e s 

s upo lied 

parts 

20 

to  49. 

99  per  cent  defective 

• 

31 

compa nees 

supp  lied 

parts 

50 

to  100 

per  cent 

defective. 

One 

can  hope  that  this  unsatis 

factory  situation 

has  improved 

s i nee 

1944; 

however,  it  certainly  can  not  have  improved  to  such  a degree  that  the  much 
more  rigid  requirements  of  guided  missiles  are  met.  It  cannot  be  over- 
emphasized that-in  all  "normal*  fields  of  technique  (e.g.,  aircraft,  auto- 
mobiles') the  final  perfection  in  quality  is  achieved  mainly  by  experience 
in  testing  under  service  conditions,  and  by  experience  in  actual  service. 
Such  experience  results  in  many  RUDM ’ s (Reports  of  Unsatisfactory  and 
Defective  Material).  In  contrast,  the  reliability  of  a guided  missile  type 
must  essentially  be  achieved  through  design  and  through  comprehensive 
reliability  testing  of  all  components,  even  before  the  missile  is  subjected 
to  flight  testing,  and  long  before  statistical  quality  control  in  mass 
production  becomes  active  and  effective. 

3.  It  is  also  said  that  the  indoctrination  of  designers  in  the  princi- 
ples of  statistical  quality  control  is  slow,  oftentimes  much  too  slow.  Thus, 
it  cannbt  be  expected  that  all  of  the  many  designers,  manufacturers,  and 
even  inspectors,  involved  in  the  design,  production,  and  quality  control  of 
guided  missile  components  could,  at  the  present  time,  have  acquired  the 

*Chasa , Harbart,  "Ball  Putt  Taath  Into  Quality  Control,"  Wings,  vol. J,  pp,  1 1 81  • 1 l 85  , Saptaaba r , 
1944.  Quotad  froa  E.L.  Grant,  Statistical  Qual ity  Control , McGraw-Hill  Book  Co.,  Inc.,  1946. 
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much  more  rigorous  criteria  of  component  reliability  testing  that  are 
indispens ib  le  to  the  creation  of  a reliable  guided  missile. 

One  comes  to  the  conclusion  that  a separate  organization,  the  relia- 
bility group,  must  he  called  into  being.  Such  a group  can  see  the  many 
hundreds  of  intricate  problems  occurring  in  specifications,  environments, 
design,  manufacturing,  and  operation,  primarily  in  the  light  of  the  over-all 
reli ab i 1 i t y . 


Whereas  the  quality  control  group  centers  its  activities  within  the 
production  branch,  the  activities  of  the  reliability  group  will  be  centered 
within  the  organization  of  development  ( i . e . , research,  design,  testing'). 
Like  many  quality  control  groups,  however,  the  reliability  group  should  be 
made  responsible  to  "top"  management  only.  The  reliability  co-ordinator 
should  be  on  a par  with  the  production  superintendent,  chief  engineer,  etc. 

Obviously  the  tasks  of  the  quality  control  and  reliability  groups  are 
complementary  and  their  activities  overlap  to  a certain  extent.  It  is 
therefore  necessary  that  the  two  groups  co-operate  fully  with  each  other. 


Fig.  9.  Typical  Organization  for  Reliability  Control. 
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Recently  an  increasing  number  of  organizational  block  diagrams,  devised 
by  various  activities,  have  shown  the  important  role  of  the  reliability 
group  in  relation  to  the  organizations  of  development  and  production.  One 
excellent  example  , designed  by  William  T.  Sumer  lin , * are  reprinted  here 
without  further  discussion.  (See  figure  9) 

COMPOSITION  OF  A RELIABILITY  GROUP 

From  the  many  different  tasks  listed  earlier  in  this  part  of  the  report, 
it  is  obvious  that  one  reliability  co-ordinator  alone  simply  cannot  perform 
such  an  enormously  complex  and  responsible  job.  !?e  will  require  a staff  of 
at  least  one  specialist  in  each  of  the  principal  fields  of  guided  missile 
technique,  such  as: 

1.  Preliminary  design. 

2.  Specifications. 

3.  Airframe  design  and  stress  analysis. 

4 . Propu Is  ion . 

5 . Electronics. 

6 . Hyd  r au  1 ics . 

7.  Control  system. 

8 . Gu idance . 

9.  Testing  methods. 

10  . Product  ion . 

11.  Statistics. 

12.  Quality  Control. 

13 • Logis  tics. 

14*  Troop  training. 

15.  Operational  analysis. 


These  specialists  will  form  the  Reliability  Co-ordination  Group,  or 
simply  the  Reliability  Group,  located  in  the  firm  of  the  main  contractor. 

The  subcontractors  will  need  a similar,  although  smaller,  reliability 
group  for  achieving  the  required  high  reliability  of  their  products  before 
they  are  sent  to  the  main  contractor.  This  will  help  in  securing  full 
understand ing  and  max imum  support  wherever  the  r e 1 i abi 1 i t y o f guided  missiles 
is  at  s take  . 

REQUIRED  QUALIFICATIONS  FOR  THE  MEMBERS  OF  THE  RELIABILITY  GROUP 

To  obtain  thehighest  efficiency  and  best  results  from  such  a reliability 
group  it  is  essential  that  each  representative  have  the  following  background 
and  ability: 

1.  He  must  be  an  expert  and  up  to  date  in  the  entire  field  of  his 
specialty,  including  theory,  design,  manufacturing,  operation,  etc.,  and 
must  assume  the  responsibility  for  the  co-ordination  of  reliability  problems. 

*Sumerlin,  William  T.,  Philco  Corporation,  Philadelphia,  Pa.  "Application)  Engineering  for  Improved 
Electronic  Reliability  in  Guided  Miaailaa."  Paper  praaanted  at  the  1952  I.R.E.  National  Convention 
New  York,  N. Y. , 6 March  1952. 
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2.  He  must  be  thoroughly  familiar  with  t*'-e  concepts  of  statistical 
quality  control  and  with  the  concepts  of  reliability  control  peculiar  to 
guided  missiles. 

3.  He  must  not  only  be  strongly  convinced  of  the  importance,  urgency, 
and  responsibility  of  his  task,  but  must  act  accordingly. 

4.  He  must  have  enthusiasm  for  his  mission  and  the  ability  to  sell  new 
ideas  to  the  numerous,  and  dissimilar,  people  w'io  can  advance  or  impair  the 
progress  of  the  reliability  of  the  missile. 

5-  He  must  be  a diplomat  in  order  that  he  .lay  overcome  the  inertir?  and 
even  the  opposition  of  people,  in  some  quarters,  and  secure  their  co- 
ope  rat  ion . 

6.  He  should  be  a capable  organizer. 

Once  the  need  of  establishing  a reliability  group  is  recognized  by  the 
top  management  of  a firm,  it  should  be  re  la t i ely  easy  to  select  qualified 
people  from  research  and  design  staffs  and  assign  them  to  this  new  task. 

STABILITY  AND  CONTINUITY  OF  PURPOSE 

In  forming  a reliability  group  one  should  realize  that  excellence  and 
continuity  of  work  are  essential  requirement,  for  ultimate  success,  i.e., 
the  attainment  of  a reliable  missile.  The  analogy  of  the  chain  that  is  no 
stronger  than  its  weakest  I ink  is  valid  also  for  the  strength  of  the 
reliability  group:  The  wealoess  or  failuie  f a single  member  can  easily 
delay  the  growth  of  the  over-all  reliability  to  such  an  extent  that  the 
missile  type  may  become  obsolete  before  it  >s  reliable  enough  even  to  be 
considered  for  mass  production. 

For  this  same  reason  one  should  prevent  frequent  changes  in  the  reli- 
ability group.  Only  special  sts  should  be  selected  who  are  willing  to  stay 
with  the  reliability  group,  and  their  particular  job,  over  a period  of 
years,  or  preferably  as  long  as  the  missile  type  is  of  importance  to  the 
f leet  .* 


Such  reliability  co-ordinators  would  then  be  able  to  accumulate  a vast 
knowledge  and  experience  about  "their"  missile  that  would  make  them  highly 
qualified  to  indoctrinate  tbs  specialists  of  the  fleet,  and  to  control  and 
maintain  the  reliability  of  the  missile  during  training  activities  and  in 
operational  use.* 


*$ee  NAHTC  lleaorendua  Report  No,  it,  "The  Qeraan  VI  Lecture,"  pegee  3-8 


RESTRICTED 


44 


conclusions 


RESIN 


1.  The  particular  difficulties  in  achieving  and  maintaining  the  over-all 

reliability  of  guided  missiles  necessitate  that  the  growth  of  the 
over-all  reliability  be  made  the  subject  of  careful  planning. 

2.  It  is  suggested  that  a family  of  theoretical  curves  showing  the  typical 
growth  of  the  over-all  re  1 iabi 1 i ty  be  used  as  a guide  for  this  planning 
and  surveillance. 

3.  The  success  of  a flight  test  program  depends  largely  on  the  functional 
reliability  of  the  flight  test  missiles.  Consequently  a reliability 
test  program  must  be  started  at  the  very  beginning  of  the  missile 
development  and  must  be  accelerated  by  all  conceivable  means.  Very 
high  priority  should  be  granted  to  such  a reliability  test  program  as  a 
who  1 e . 

4.  Reliability  test  programs  must  be  conducted  as  long  as  a missile  type 
is  in  development  and  production. 

5.  Reliability  test  programs  must  cover  all  conceivable  "failure  hazards" 
occurring  from  the  stage  of  preliminary  design  through  all  stages  of 
design,  flight  testing,  production,  transportation,  storage,  handling, 
and  service  use . 

fi.  The  cost  of  a reliability  test  program  will  be  relatively  small  and  be 
many  times  compensated  by  the  savings  of  numerous  expensive  flight  test 
missiles  and  by  the  huge  savings  of  service  missiles  that  otherwise 
wou Id  fail. 

7.  Time  saving  in  the  development  of  a guided  missile  weapon  can  be  a 
decisive  military  factor.  For  this  reason  the  acceleration  of  a 
reliability  test  program  should  be  made  a task  of  primary  importance. 

8.  To  achieve  a maximum  rate  of  growth  of  over-all  reliability,  appropriate 
priorities  should  be  established  within  the  reliability  test  program. 

0.  A "Priority  Index,"  PI,  is  suggested  that  may  help  in  rational  determi- 
nation of  the  test  priorities.  Such  a priority  index  may  also  help  to 
overcome  severe  bottlenecks  in  testing  and  may  s t i mu l a te  the  co-operation 
of  the  designers  in  planning  and  conducting  a reliability  test  program. 

1C-  The  Priority  Index,  PI,  supplemented  by  several  rules,  can  also  be  a 
guide  for  determining  the  appropriate  sample  size  for  each  test  case. 

11.  Because  many  of  the  critical  stresses  and  conditions  will  not  be  known 
numerically  in  the  early  stages  of  a missile  development,  it  is  neces- 
sary that  these  stresses  be  conservatively  estimated  and  specified  for 
preliminary  use  in  the  development  of  the  components. 

12.  lhe  standardized  components  of  a guided  missile  should  be  given  first 
attention  in  reliability  testing  and  for  adaption  to  the  missile. 

13.  Newly  developed  component  types  should  not  be  used  and  expended  in  a 
flight  test  missile  until  they  have  attained  a satisfactory  reliability. 

14.  In  the  interest  of  a rapid  growth  of  the  over-all  reliability,  a proto- 
type unit  should  be  tested  up  to  failure  as  extensively  as  feasible. 

15.  The  knowledge  that  can  be  extracted  from  testing  prototype  units  can  be 
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greatly  increased  if  the  various  kinds  of  tests  are  conducted  in  the 
proper  sequence. 

16.  A single  prototype  unit,  having  heen  tested  to  failure,  can  be  re-used 
for  the  suhsequent  categories  of  tests  after  the  part  that  has  failed 
has  been  repaired  or  replaced. 

17.  Nonavailability  of  a component  for  testing  in  the  reliability  program 
should  be  considered  as  an  indication  of  poor  organization,  especially 
when  such  a component  is  intended  to  be  used  in  a flight  test  missile. 

18-  Reduction  of  the  severity  of  a stress  or  environmental  condition  is 
particularly  desirable  because  not  only  one  but  many  components  will 
become  more  reliable  through  such  reduction. 

19 . The  testing  of  compl ex  compone  nts  suffering  from  mu ltiple  interdependent 
conditions  requires  considerable  numbers  of  test  units.  For  this  reason 
such  tests  can  be  performed  only  in  the  later  stages  of  development. 
Such  components  are  the  great  liabilities  to  the  de ve 1 opme n t o f a guided 
missile.  They  should  therefore  be  avoided  as  much  as  feasible. 

20.  Sporadic  detection  and  elimination  of  causes  of  failure  must  be  sup- 
planted by  a determined  systematic  and  comprehensive  scrutiny,  if  rapid 
growth  of  the  over-all  reliability  is  to  be  attained. 

21.  It  is  imperative  that  the  designer  co-operate  closely  in  the  planning 
and  conducting  of  a reliability  test  program.  The  personal  care  and 
responsibility  for  "his"  component  should  extend  over  all  stages  of 
designing,  testing,  production,  handling,  and  operation. 

22.  To  penetrate  the  many  critical  reliability  problems,  the  reliability 
co-ordinator  will  need  the  help  of  a group  of  highly  r e 1 i ab i 1 i t y - mi nde d 

specialists  in  the  various  fields  of  techniques  related  to  guided 
missiles. 

23-  The  reliability  group  must  feel  responsible  for  the  ultimate  functional 
reliability  of  a missile  in  service.  It  is  therefore  desirable  that 
the  reliability  group  "go  with  the  missile"  through  all  its  stages  of 
development,  production,  transportation  and  operation. 

24.  The  activities  of  the  reliability  group  will  be  centered  in  the  develop- 
ment organization.  The  group  should,  however,  be  made  responsible  only 
to  "top"  management. 
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